{ "Event": { "published": true, "date": "2021-05-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-05-24", "timestamp": 1621900981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "819fbff3-d5f7-48fe-a2e2-ff2553fa4a61", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b13786-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875996, "uuid": "76975dfd-c293-4a60-ace3-9d8cf3e911d3", "comment": "Malware payload (Dridex)", "value": "6691ac3d39388ca7c4118cdb20f4f24d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875996, "uuid": "b90289d9-e953-4594-b89b-0ff4a31c91d7", "comment": "Malware payload (Dridex)", "value": "001eb60cfd34d6fcf445d1428b1a8d15085c51b5af3d8b9a0f2c2859e1c08ae3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875996, "uuid": "860a751c-72e6-4ce6-92f0-69b955335408", "comment": "Malware payload (Dridex)", "value": "9dff3462bacfb7c9a864d7b74e1e0e1f9a2b5ea8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875996, "uuid": "4ad1335a-7167-4610-846e-0c54e2f61f27", "comment": "Malware payload (Dridex)", "value": "24a34284ac9a7775b507bec6f94696e517a6f0bf4280d501d5f50e4cb66c9dfed8f1796c8ee6f6d5e7489bea7d57149c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875996, "uuid": "03189d32-fa33-42e9-b6a8-fc983e2fb97c", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875996, "uuid": "83475851-3fae-4138-b922-31532fe963f0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875996, "uuid": "5bbb494b-fd4c-4d06-8004-41adf1d58f5d", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875996, "uuid": "ef113065-34e1-426f-bc64-4eb0502a652c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875996, "uuid": "386ad5a5-c2a4-4960-b8b6-18176cc58977", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875996, "uuid": "4673d00e-95fc-44ad-8c1c-6bd337eca34f", "value": "6691ac3d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6696e8e-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818122, "uuid": "aca96b25-40ec-4628-ba80-eefa53898017", "comment": "Malware payload (Dridex)", "value": "7d3c7cfc64321d8d5d2fca18dccf1a88", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818122, "uuid": "0490f004-8352-43ff-a3c5-c035be7fd1f1", "comment": "Malware payload (Dridex)", "value": "00873120b333ad3c31cfe579e690857046e55eddeb4ff781d8327a31e8694b8c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818122, "uuid": "0d555fc0-5252-469f-8943-17efff434992", "comment": "Malware payload (Dridex)", "value": "258a7dfc1dd496617f07a918a948f5262b11cf5f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818122, "uuid": "da91b483-86ee-4544-bc78-3c768664e6ac", "comment": "Malware payload (Dridex)", "value": "d2eb5aec8d440452c281614a404f181c6304ac95017a749b1a2290162c5b28673585235d0785d5ddce29c75511fecce5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818122, "uuid": "06b9d532-c5b5-4111-a0aa-f341e0b921bb", "value": "26F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818122, "uuid": "95d0c86e-68ed-4447-bd10-d77716f40333", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818122, "uuid": "e474290b-f36d-49c1-9d87-b60e47b2789a", "value": "3072:g9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:g9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818122, "uuid": "e36a1752-6a1b-4d27-8f43-dda32b2399b4", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818122, "uuid": "3fe573a6-f2ab-4664-b177-0bdc3bc54376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818122, "uuid": "0d55551c-67ba-4a2c-af63-286ff346c181", "value": "7d3c7cfc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f402b7-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621878899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878899, "uuid": "7cb8a95f-0835-4f0a-8b8f-58e6e7264740", "comment": "Malware payload (AgentTesla)", "value": "8d973608a9b4bc6b1668d6f9a83bcfdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878899, "uuid": "63c7d111-4716-4ef5-a9c8-a08156845b23", "comment": "Malware payload (AgentTesla)", "value": "010181f621492ec1071068547eb073ed7569ae4e532ca13609274af5d8e060da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878899, "uuid": "3fb7d839-0433-40b9-a680-8a718905092a", "comment": "Malware payload (AgentTesla)", "value": "838d38f08303dc1c00da026f2792e5a52ee32cfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878899, "uuid": "10a522ad-3a74-4562-a167-2d067eb7d2f0", "comment": "Malware payload (AgentTesla)", "value": "4d86fedb0659a89238ba31392eb8892af1db28dbffc6523caa8a7268e272e2b660cf3bd2c6cfbb8da400f16ea5c96e56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878899, "uuid": "c64c30aa-c9d6-41dc-8fb1-29e35447c307", "value": "0C158C2C206EF126C1A9C3794AD4402BE591DF3B7031BD19ECD73B696739E41B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878899, "uuid": "64b04921-55c7-4079-a074-a65aba17d7b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878899, "uuid": "66b0f0b2-df46-424a-87db-2d2267a08604", "value": "24576:3LBCww6g+Nw/JOnpINTtOy7r45FcIFnTm:3LBCww7swg8Ay7GFnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878899, "uuid": "22eb881e-2004-413f-8767-dccbd7192367", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878899, "uuid": "bd9a4cab-83a8-47de-acb0-9129fc8016cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878899, "uuid": "9cebfb5e-75bf-4f9f-b415-4a9736e6b153", "value": "8d973608a9b4bc6b1668d6f9a83bcfdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5388a14e-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825285, "uuid": "e5918d30-9c5d-42a6-a577-4b3157a43193", "comment": "Malware payload (Dridex)", "value": "e9b457475bd19ab154598139fd9ec450", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825285, "uuid": "4d9cf4d9-2758-4bef-8f99-f61e6ce9d625", "comment": "Malware payload (Dridex)", "value": "01184c532b538b8384b0cac09f1db2118db19a28652033c2beb7899c10176e94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825285, "uuid": "3c175afd-d929-4460-82ba-5735823133ae", "comment": "Malware payload (Dridex)", "value": "7ab2f040ac8dcb5cc06b7027a21daa319534cb15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825285, "uuid": "106d977b-ffa3-42ed-b0a7-23fcc6f4ca1a", "comment": "Malware payload (Dridex)", "value": "18a07318133b66a6d2a58a878872dbc4cb138ddc8a84ca09cd765f2d4bfb1d6297246d736ef4e547ba822a78767da58e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825285, "uuid": "6b3891e0-dac3-436d-a960-3a63849ac094", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825285, "uuid": "3557b085-d774-49c4-9165-059bafbbae38", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825285, "uuid": "b63a60cc-db03-4e34-b5c4-05b245a0b3b3", "value": "3072:TmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:iLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825285, "uuid": "d56680aa-4c33-4a82-a705-48a5841a8aa9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825285, "uuid": "4fb1f881-50bc-43e9-97ce-9a315837f8f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825285, "uuid": "937306d8-cb0b-4246-82d6-93d2fea4a865", "value": "e9b45747_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e25aef1-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872601, "uuid": "007092ad-d57d-4d60-94fc-dac45dfc3d11", "comment": "Malware payload", "value": "08df20978e7d41b602062e1e3c8b46a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872601, "uuid": "5e9380f8-ee97-49ba-b914-294e135a578b", "comment": "Malware payload", "value": "0162d1dea440e76cf7a41bc1de78bae3281e28e3bcde43704c024b3e7f92f4d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872601, "uuid": "df699554-7fb0-4dc6-8430-97153fe10dba", "comment": "Malware payload", "value": "1895e374e3a13560f23af91fda9468b1aa4a658b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872601, "uuid": "7b120317-b619-4e02-9da3-7bd2e54ef2e5", "comment": "Malware payload", "value": "f9465347e167e7e3aaf259667c5d9a58700559730ddc3b00d3330d05954e119c9d26eeb45709747f4b20e6bcae49b324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872601, "uuid": "ed6612a1-2f25-404c-95b4-60bb912da18c", "value": "3D05D41F2D99E119E1D8C63D46F80027FF42DBB3203AAED698C777AD0694D41B86162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872601, "uuid": "c385d185-e6fe-4f77-8ff9-43a160341f13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872601, "uuid": "da33c865-fe76-41ee-98ea-d93be4b7c88c", "value": "12288:0fkfBCLDtknwiPxJFgIQu6TTbN4Ok/jn9E5Gty4cvxVxCkH6M:hfBCLonnQHiBjC5Oy4mHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872601, "uuid": "eb315f2d-8033-492a-bc35-5bfe97897a68", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872601, "uuid": "657b5fb7-48e7-4206-a007-06f402bd6da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872601, "uuid": "03cfaf6b-f38a-41bf-ba26-faffefd54579", "value": "WiedEFm3X61CAd6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6514ed48-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854090, "uuid": "ef8b2bf3-23d4-4b52-8212-07f5343a376d", "comment": "Malware payload (Dridex)", "value": "56c82e0193581ee0e4ad8f6a5536dc47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854090, "uuid": "45a72f42-de49-440d-995e-727b02af89cd", "comment": "Malware payload (Dridex)", "value": "0193b24a1d227c2ff6fe818a23d5c0555a6a752f1bc3a8ee46a282bd3184f42d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854090, "uuid": "e9ec7411-95ef-4e6d-a995-ef4879ed3857", "comment": "Malware payload (Dridex)", "value": "a737e31c74a179a9df832192ca200c0b10943b7e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854090, "uuid": "d57b1f72-ae0a-4d51-aa1a-d2ce2390ae6f", "comment": "Malware payload (Dridex)", "value": "f7745e0b74dc47d40a36d6d555fde6ffcd4e60ba47e1c65428cc0aa87cd7f9d732d069bc827a917fb6c6c185d68bda70", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854090, "uuid": "32caaccd-89f3-4916-83e0-2c974afb06d2", "value": "0C04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854090, "uuid": "9a727e76-d1dc-4457-a36f-132e847521f2", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854090, "uuid": "fbfa242d-e2a4-4702-a987-e9ab8f4a91d8", "value": "3072:gV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:gV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854090, "uuid": "562d2e9c-0cb0-4aa5-92af-14c43687de2a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854090, "uuid": "79f9e2fa-d8e0-4a57-a939-6c39692c318d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854090, "uuid": "316ee11f-a0ef-4255-bbee-0a5f52b14112", "value": "56c82e01_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f764b8d2-bc53-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621835438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835438, "uuid": "97234c8f-5bbe-4ae4-908e-94a83f19ff71", "comment": "Malware payload (AgentTesla)", "value": "c19c40e19cccffd8c4b3ee4af592ef73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835438, "uuid": "b85e1296-71b8-4e61-9420-629d7a6ef378", "comment": "Malware payload (AgentTesla)", "value": "01a0491697893c69dec98d83da5a0be3f538e812257db02b5e3e42d41d77afb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835438, "uuid": "3a3fab19-8756-48a4-ab44-4133abe5b6d9", "comment": "Malware payload (AgentTesla)", "value": "c7e6a72f24577219fafb616ec1c9a08b13366956", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835438, "uuid": "c3f916f3-d033-4daa-89ae-765c4b541ff6", "comment": "Malware payload (AgentTesla)", "value": "e32a82b489c6f75ebb5f2b9db87ab751f0cc7a5ab264b7812b0d9c0d012043a586a64896fd1e325764a7f3cf6a8e1d0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835438, "uuid": "ead87ff0-9d18-421c-9582-b5148d2bf2a0", "value": "27C423258407C2A8789CABD0BEB8455A3AE507F0B4C9CBBCA670A050657D6C733D7BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835438, "uuid": "98b958a8-6a93-471d-acfc-2ea8982b89fe", "value": "12288:9buBS3WzSZvOPNnKLKOP1PA6Qdvr6HpF7ZL32:9buBS33uNnKOuY6or6532", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621835438, "uuid": "3e0632b8-9ebb-41f7-873a-178c7943d83b", "value": 568237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621835438, "uuid": "4af9a4d4-6fa0-4f91-87f8-85924d4fad73", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835438, "uuid": "9a6a4f70-144b-4902-a5c5-34e8222fbce6", "value": "AWB#8001187 SHIPPING DOCUMENTS PL+BL+CI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807e36d7-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854136, "uuid": "449aad16-8503-4367-a44e-657b726bd41b", "comment": "Malware payload (Dridex)", "value": "39a0fabbf5c4acd7549ca94ad715e0a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854136, "uuid": "a93c55ff-799b-489c-a1f9-b5e0fe472495", "comment": "Malware payload (Dridex)", "value": "01d60fa33ec01f860432aa80f821880ed8ca6fa4ae24c115722366dfd31a2c80", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854136, "uuid": "5d789aef-0697-4708-9fe4-bc3bf7b2a7ab", "comment": "Malware payload (Dridex)", "value": "7c5f14b092e512c32848941d73077d4247785555", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854136, "uuid": "2de7c890-f449-4497-adaf-6518af77cf00", "comment": "Malware payload (Dridex)", "value": "b47ee7267cd92c1812f683a88b9dec2c4404ad7e4fdb0808c443cd99a233afba30c2565fa5be6dc41a95f0354d5c1133", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854136, "uuid": "8e48975a-ca9d-41b4-8817-df1d5562d7bd", "value": "85F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B49671FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854136, "uuid": "3c7bbcba-7fe0-47b1-a35c-ac2c9f84b4d3", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854136, "uuid": "39540e74-f4b5-4974-b27b-282e2d1f2e7b", "value": "3072:IA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:I3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854136, "uuid": "93f8a13f-b048-448c-9734-c0918909f1bf", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854136, "uuid": "095436c2-9014-45b3-8f8a-e9c4028d26f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854136, "uuid": "ab2572f8-55d9-42e5-ab95-eae6ec2e5917", "value": "39a0fabb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee35b6a-bcb7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621878212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878212, "uuid": "bb08bf1b-cda7-4fb3-9343-0f6b53f3482e", "comment": "Malware payload (SnakeKeylogger)", "value": "06900c92d534bd72a06eaa7f756e9346", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878212, "uuid": "4477a2be-b8b0-4388-9aab-7c8c5cd7b45b", "comment": "Malware payload (SnakeKeylogger)", "value": "01f08254913be194ca44adb8fb4d43518443f00be2bc74eeebff623feec51ac2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878212, "uuid": "7c73dbdf-59de-4f08-bcd5-6feb5eec82b1", "comment": "Malware payload (SnakeKeylogger)", "value": "5b744fed022af9d6ef800df57bf9579a4f2be3fe", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878212, "uuid": "52e89e82-c786-4df7-9592-626613532e4b", "comment": "Malware payload (SnakeKeylogger)", "value": "95847d1d8fb01bb0ddb5c60efc5030298d64c1644629e0cce3048264fb6a236d2bec5107d33769d8637d8a057397e50e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878212, "uuid": "1f82d641-2830-4bb7-a696-d050d3e2ae22", "value": "074516DC5D1AB01AC059D23575C494BFE753EF3320B8AAA699C3FBC95727D4034822AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878212, "uuid": "fc01fb0e-0090-4666-99c3-3721c986c199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878212, "uuid": "ab7afc5c-1fa0-4141-956f-a04f5dd52ebe", "value": "12288:9zL8gyN8/GXyEK7pbceozP4Eadr0ce/CcTMFdF6CTzQoy09AyGff7ICfLc:9v8O/GXyxpceqPGe//Kqc1yd8CfLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878212, "uuid": "034ec0dc-3a1d-4006-9315-52197a9476b2", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878212, "uuid": "408b7e01-7518-4b15-a537-31b036ba8944", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878212, "uuid": "f9f4b1c3-c6ba-4f2a-ba2c-8f8a8ff6cbaa", "value": "Nuevo orden.PDF______________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0306e3c-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621837895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837895, "uuid": "af0769f5-05ab-4b80-a0cf-d90b3c01fbc2", "comment": "Malware payload (RaccoonStealer)", "value": "1c59e4fbaf59f978a51ca4e2f63ffe87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837895, "uuid": "49f32304-0965-473a-9ad3-834cb5d989a6", "comment": "Malware payload (RaccoonStealer)", "value": "020766cdf4f0fbb51c4037c9563f1df152a45d59bfabe17726d6d45f3179b423", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837895, "uuid": "3493bf06-d068-43ef-9760-eceecede0134", "comment": "Malware payload (RaccoonStealer)", "value": "a0a2e98959b05182af09090d43bf7eb41f52634c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837895, "uuid": "fa6b490c-a81d-4a50-8eac-117d222d17e7", "comment": "Malware payload (RaccoonStealer)", "value": "ae335dbc03383c025ab025940a59e9ea2a653deb4249428b2b515bb20bfaee6e4f5c9275975f0059f89c4483e3e992f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837895, "uuid": "733beb5a-49e0-48bf-86f1-389dc2777280", "value": "EA05F131A6A0C034F1AF15F189B5C2B8E52A7DA1672440FF52C63AEA55379E4AF3074F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837895, "uuid": "cf98f4e4-3030-4e49-b661-76ed6d25f22a", "value": "48d2401545bc23ddf9125d8d09f6c7f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837895, "uuid": "59170588-ee8c-4442-a5be-bc9466bcbfa1", "value": "12288:Km0+eQDSCvrKdZi9jw5NX/4SC9jv+sZY9p9zw21HQ3BWzk4JI/Vl3rQSJdXsL:peQrUywHP4SCNvByxw21XJI/VtdXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837895, "uuid": "9818cea1-9e17-4dc6-bd6a-5a145ced89d2", "value": 858624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837895, "uuid": "f9bca13d-c988-431c-bfc7-8b61e6c2a043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837895, "uuid": "8cb734fe-7f70-450d-a587-25b012af3d31", "value": "1c59e4fbaf59f978a51ca4e2f63ffe87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3110affa-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621838112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838112, "uuid": "33d9ee60-1183-40e0-b616-114fb9bdd8c9", "comment": "Malware payload (Formbook)", "value": "5a078df038f615ab3fccfb150edbc567", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838112, "uuid": "1c666d9a-71dd-459e-a9d9-d5e4d41d72f8", "comment": "Malware payload (Formbook)", "value": "021c6f0f095881d4a62de41a960655c6879c5076c0b6901ab25a1b36eb8bab62", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838112, "uuid": "18e6982e-72e4-455a-a77e-341b9062e8d5", "comment": "Malware payload (Formbook)", "value": "d1a7e219b73bafbd08f9616f5669ee812db071d4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838112, "uuid": "7b471d6d-3c51-490d-846f-270c5319b3b9", "comment": "Malware payload (Formbook)", "value": "8efd5abfd25a2b47378ba9a86f1280020efc8b577905bc32be812b8d7f6678dd6c1477ac41fd84cf80c458ed828ad5d2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838112, "uuid": "376f4eda-50b9-42e1-8ad2-916e0b0d69fe", "value": "365533F2ABC04BDBC75AD6370942C9782155AD6881AFE423B32DB7447AF537207C2E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838112, "uuid": "22b9b07d-30d4-4506-ab04-5c14b1dd04dd", "value": "24576:+AiyL8fOur3o90Mxyw5FDqt3pLyCjlDOopWtgb9fFwQ86J:+LyL+3oysqrLyCjliu3b9iS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838112, "uuid": "976dab8d-87eb-4805-9cc7-05f82cce5bee", "value": 1376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838112, "uuid": "ce261438-e08a-40d7-86a4-d68b3ae4ce70", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838112, "uuid": "667e572a-f243-404b-897d-240223a23c64", "value": "ORDER TBT - SF21-12.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a316913d-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836155, "uuid": "cf3d786f-5022-4af0-bce1-ada96f5fbbdf", "comment": "Malware payload (Dridex)", "value": "a10cec5322f5ce263b3899997599d43e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836155, "uuid": "a5a75109-782c-4dd6-a7ef-2e3614227eec", "comment": "Malware payload (Dridex)", "value": "024ce579ddbb903640948a9bb0d3a1ed8ddf59b9b6d5eb82b55ce7f3402b220b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836155, "uuid": "b8d2191f-e44c-4ae4-a491-2b95f158f157", "comment": "Malware payload (Dridex)", "value": "2c147794a8594a29217fc899fb5ce9b3ece98ce5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836155, "uuid": "f9d7248d-10e0-4d60-b2f5-442f9c21006d", "comment": "Malware payload (Dridex)", "value": "d2eb46e291c6b21b2771efcd1cd71b334e0a939269145483d55f2034f02d8ca0d2dc4a97f6a5aad0073799bbd111de0a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836155, "uuid": "75030504-eb22-4427-a245-08208ac2cf50", "value": "C9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836155, "uuid": "87e10de8-adc3-4042-9656-b4616097fc9d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836155, "uuid": "e30a475d-331e-4603-9087-bc6c7114f430", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836155, "uuid": "2530c4e6-d910-4353-9aee-3f4817335263", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836155, "uuid": "13bf5e87-7491-4033-bbd5-e646d19fdfbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836155, "uuid": "d236cd74-9879-40f8-91b1-b6989beffb21", "value": "a10cec53_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d18047-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621879353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879353, "uuid": "b45eea38-c2ef-4cd6-a83f-635ba4b4a494", "comment": "Malware payload (SnakeKeylogger)", "value": "04bfcdff059729500b0cafbdde496970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879353, "uuid": "129f3511-df44-4695-b798-e65ba1257265", "comment": "Malware payload (SnakeKeylogger)", "value": "02d91e681c05773e6ee04021aff6b7a0710fe6fac10839e43751ed64445212fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879353, "uuid": "87c959c9-2489-4911-9024-130963d9fe11", "comment": "Malware payload (SnakeKeylogger)", "value": "e2faeded7a4c1ac2fb0453a54f025ea46e6ab87a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879353, "uuid": "51fdba06-3542-4ed9-bb85-95432f16f0c4", "comment": "Malware payload (SnakeKeylogger)", "value": "98e733f042073e0831ed16b17452113ad5a1a7af86036de104d18b6c07f17a6519459a3fe564528be616be634425d157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879353, "uuid": "e3eab4f9-3bc8-426c-895d-98edb7cad790", "value": "3B25592C156AF522D6A8C2794AD4403BE591DF333131BD69E8D33F587739E80B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879353, "uuid": "b691f9b2-a914-4b43-b182-99b3b105688c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879353, "uuid": "03d32eba-dbc4-48ba-8512-8cba1c42f76a", "value": "12288:e2jBCPy+FznChQkPbeVVZHPhlhLiyCCTVJKga/RJyVeYdQ0dBwgk/YR12:lBCPDtkPbexPhfLi6D3qR/Yu00gk/YR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879353, "uuid": "c3896330-28f9-4c43-855d-b40da4239802", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879353, "uuid": "7d386bda-23fa-4f74-8d9b-17bd78524217", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879353, "uuid": "fe15bc9a-c9fe-4bd6-98b9-6072129c950c", "value": "ThreadLocal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11cd6d4e-bc51-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621834194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834194, "uuid": "067cd2be-420b-4cbc-a587-3256b5cd287c", "comment": "Malware payload", "value": "5edce790dbf0f2111f96fff961215d96", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834194, "uuid": "002a05e6-c4f3-425a-99af-6959ea296129", "comment": "Malware payload", "value": "030c446ac1fac992dadf50c3926a07f9135232b6fbb0eda2ac40701d355567cd", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834194, "uuid": "b529fac7-00f3-4fe3-9a74-3f20622607e5", "comment": "Malware payload", "value": "1d3779a6104b63aec0b794ee02cc218bc0eb5df4", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834194, "uuid": "af64211c-5838-418e-b968-930337f1d63b", "comment": "Malware payload", "value": "fcd204490d5370cdc2970af7f6b397fd00dacdebf72f52a45ad15d6ef2584d8a46095aa2df1d2d0b251a870951ecd2f8", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834194, "uuid": "6e3eb7ad-e96f-4681-9954-2b691266629f", "value": "A9242358E644758EEFBA6FB91043178AE487B29AFE7C087087407094FD4E21D5D8DE8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834194, "uuid": "298fa51a-d146-4f79-9abf-cd93c5c5feb0", "value": "6144:Q3qSDbk9QokZ0v+G2+S/Dp7SbCHWZsOGmF:QGoSo0OGGmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834194, "uuid": "aa84a8ef-e26d-475e-90e1-10e05d07d3db", "value": 222215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834194, "uuid": "e4028a25-ae08-42ef-85d7-2222914c28dd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834194, "uuid": "36d4eb1f-dc28-49e8-843a-cdfa33975ae8", "value": "Final Quotation.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41742c67-bc68-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621844152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844152, "uuid": "c96390a3-701d-44c6-a101-a65d150b9d90", "comment": "Malware payload (Loki)", "value": "fdbdc7266f2ba91c43882484f8f9e6ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844152, "uuid": "890626f0-8daf-4e84-9081-620a9b2892af", "comment": "Malware payload (Loki)", "value": "031d30c5d36700891265eb09045e827884ec4cc4e4b1c56f9e136c88338b3a9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844152, "uuid": "8a316d7b-5391-4e84-bc02-e88b19ba905c", "comment": "Malware payload (Loki)", "value": "e7e1e32fd0b683bd72e86e7c68679d491eb527e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844152, "uuid": "f5a8a52b-fc05-4ac7-a23c-f2571742d980", "comment": "Malware payload (Loki)", "value": "9781ff84237b465cd391e8bf443aa50e3af58012d1737974c53254c56ecdea88312410e0037fb2eff43551655f188454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844152, "uuid": "e9b154b7-4c26-4a48-a5ed-1e7fc3ae4aa3", "value": "86648D30A6A1C035E4BB56B449B5C3BC653A7DA17B3480FB22C63BED86345E59D3078B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844152, "uuid": "6ca7c85e-4a96-440e-b5cb-1282805ea753", "value": "a1546b2dd90d8ce5446c70bec3b077b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844152, "uuid": "94a0a35c-d229-49ef-b9bf-5f8013fa1f6e", "value": "6144:87zBqWbWWnN+bkITSOyIFSFpmLgCLb4T7izEVQak2FYkpv:87zBqWbWWwvTS4qTCLbc7pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621844152, "uuid": "906cb1ca-2d43-458c-9dfc-9ce71d1a964b", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621844152, "uuid": "ae3cdf22-3ffc-4c38-b8f1-f9f36da661b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844152, "uuid": "a11a1bc6-3c1f-4ff5-bf6b-f0f40ffa5146", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c7837c-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872959, "uuid": "763c6ce6-e227-47c8-8bac-30d8460cda17", "comment": "Malware payload (AgentTesla)", "value": "71d11dc8498ecdb70a6fd8f6decd5c90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872959, "uuid": "90cf3886-aa20-4ceb-ba43-89855c953759", "comment": "Malware payload (AgentTesla)", "value": "03ef8714bc60d14808b9d17373c5e34198a4e7a60cdebab1e18f9e49c394f7d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872959, "uuid": "2caaee3e-8ec1-40fc-ac5b-b2ae82e1ad8e", "comment": "Malware payload (AgentTesla)", "value": "b35f2f8b59e2829af4fe2d1b656b1b647e57c9cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872959, "uuid": "e66a470b-f67c-4bcf-ac48-bd0a7cf3dfd3", "comment": "Malware payload (AgentTesla)", "value": "f404c334cca0769786d2ef61b8261b28a2180f086a164920811411f5d46530ad89b7b1a4a191eee0ee3fe9803b1a9151", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872959, "uuid": "06fae502-f665-4015-aa15-173ddc493638", "value": "0F455A0AFB057E64C11D0E724142095D83EED4932332FBBF9199E5E27E237A65A4E1E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872959, "uuid": "ac1681b9-e201-42f7-8e4e-40f0789e8bb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872959, "uuid": "14d7f558-7828-4c68-b673-e6d00cf5a61a", "value": "24576:nebY/2xLSLAdQKvYsnkZJSgLfPDpmuZeZk:nIvXdQKwsnkZ4gLfPDQuZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872959, "uuid": "d804472f-0d4f-419a-8887-5eea46a4bf37", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872959, "uuid": "9ba790d7-7823-45f4-af8f-6458123078d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872959, "uuid": "f889d19a-2f3f-4d4e-a2a6-e9e423decdf3", "value": "RFQ#1875-ET1-002.eXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582c4e55-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854069, "uuid": "502c1a3a-8b61-442d-93f5-9d4781d0b991", "comment": "Malware payload (Dridex)", "value": "512b00825b718638d43da12b3b900ff6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854069, "uuid": "75c8c9dc-b40b-4306-886c-74003a0979e6", "comment": "Malware payload (Dridex)", "value": "03f285659d5f39df63d867d2511bfc037714ed6b66889e80e55ad8e88d13444f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854069, "uuid": "76bcaac7-cbba-4bf5-b93a-54d29a946f06", "comment": "Malware payload (Dridex)", "value": "eb52aa626ba015a50c0e533dde61e3f0088526f5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854069, "uuid": "1371b576-e03c-4004-939d-139eb02b5f20", "comment": "Malware payload (Dridex)", "value": "4f3d67de553e25f579eacf9cf04f546300745ea8b00b482d3c024b41446b5a74906b124214afe96216fa912619b15a08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854069, "uuid": "c58d0dd8-c223-4afe-9882-bd578d5daaba", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854069, "uuid": "ca34cad4-bbe7-4dbd-8b8b-69e40fb015ef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854069, "uuid": "f924f79d-31e1-41e7-9970-b94027c2777a", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854069, "uuid": "6477aa9b-12fc-4a08-a01e-0db060a1e1ce", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854069, "uuid": "f90fe864-c113-48f5-bebb-e3442716810f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854069, "uuid": "068321ff-bf97-4815-af72-ea0b860746a7", "value": "512b0082_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ccda3d-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846924, "uuid": "8ed82268-321c-4c75-a92c-401a61f5f9d2", "comment": "Malware payload (Dridex)", "value": "031c2a81f61c62557d984d23cd252089", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846924, "uuid": "ee6b474a-2b5c-48d6-8ae2-36ee0f1b77d9", "comment": "Malware payload (Dridex)", "value": "0453f0bbe6e83a9be4710579e4f9f3259ff5f5e78cb45372b398452a45f958f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846924, "uuid": "887bc62c-ec73-493d-9811-bd095ed081f0", "comment": "Malware payload (Dridex)", "value": "c09d178adf682e8d7f7beccec53f253ec65d3fc5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846924, "uuid": "b1353215-2c87-4eb1-8c3e-59a69f628128", "comment": "Malware payload (Dridex)", "value": "bb3cb02945e264bac5d7ff62d5c2c91a192cc4d69ae57a380f39fe0b3ff6d924ea04415706de44361d88aae69df48a06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846924, "uuid": "da30cf01-8c11-4faf-9d2a-570bfc17d61a", "value": "4EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846924, "uuid": "1cc683bb-cf98-4e21-b75b-599e272902fb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846924, "uuid": "610d5f08-ec9e-4e9d-a6d8-c145d790eaec", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846924, "uuid": "713cad74-7610-4f3b-9a87-8b5582f25d91", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846924, "uuid": "9e19ee50-22ca-403a-90b6-4d1a020b8a7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846924, "uuid": "5f05883b-7876-4422-b297-29c271956209", "value": "031c2a81_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aacaee2-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818076, "uuid": "d6a81cec-b022-4264-83bf-db2e09a0593f", "comment": "Malware payload (Dridex)", "value": "d1622ee8db9b4d47682060f26ac70749", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818076, "uuid": "46aa02d8-41f6-4649-bb26-af673ac33179", "comment": "Malware payload (Dridex)", "value": "0462cda39493a9c30a2c98bc0f46310f73fb596b893e53325b6188e7110777a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818076, "uuid": "bc8c08cf-714a-4632-bece-4284ba03ea32", "comment": "Malware payload (Dridex)", "value": "0fd47651db554bacc6ad43157438a7d057b3d4e1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818076, "uuid": "ff4c967e-9d1d-4dd5-a8de-07e6dad31ecc", "comment": "Malware payload (Dridex)", "value": "0503936d6bd48c57d6a8ec6067be1cb1f3b70f8377f8e5141424bbace00bddeb79f51b67f9f145246491f2e31bce13e2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818076, "uuid": "eada0e84-60a8-40af-8d70-bea7ebd3d1e6", "value": "25F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818076, "uuid": "1fd09d93-37cb-4134-8dfe-da12caa11378", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818076, "uuid": "1bb60d67-a7d5-4d71-8439-66fd4a4ef308", "value": "3072:g5mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:goLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818076, "uuid": "7b878a6d-043f-4a6e-a8d2-280d7d359505", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818076, "uuid": "d4ea4748-0a93-4cb5-a4c8-0a87b619e235", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818076, "uuid": "244ac9f5-473e-43be-b5b2-bbff7c96f07e", "value": "d1622ee8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e863d04-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872843, "uuid": "c9c13fa1-581a-434c-b694-b547ed496802", "comment": "Malware payload", "value": "0d7cf01e79d3a6a9f4374842e8fb9598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872843, "uuid": "deffec0d-a09b-426e-819a-c690e3789bc3", "comment": "Malware payload", "value": "04784d46d726d64b9c5a4562c89230e2be58e0349b0bee477c56699676549ef9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872843, "uuid": "e015ff60-27d7-453e-b4b9-2972503bb8f6", "comment": "Malware payload", "value": "222365dab4d6229890d167e8db998aa92bd99a14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872843, "uuid": "70a88e5b-5ab3-4cce-8fb8-599f9680b6ae", "comment": "Malware payload", "value": "9b6cba06f09ab209e3af3fcfa2ab40a61a47e0f1257e203511848bff304a5c58a3763f749f357d49a873522aad97ae22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872843, "uuid": "fe0fad84-1764-4fe1-97c1-17abdff8b95f", "value": "CD15E112B5C68872D5231A711939A720593B7D544B389A0F63EC3D2FBBB32926931F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872843, "uuid": "d953baab-41c6-4cdc-a355-c10e43c860c5", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872843, "uuid": "357cf103-1da7-46e1-86fb-86715da11d07", "value": "24576:eHLmCiIhVQZd5zZxGQF7RlotMuk3G39rKKuOcn:zBd5tx/FxyOKuOcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872843, "uuid": "9c5548e4-37b9-48f8-9e94-af5cc60900d0", "value": 912264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872843, "uuid": "6dd2b5f8-ff73-490b-a556-e6087c1c970c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872843, "uuid": "d3b777b0-fc9a-4790-8f8f-bd82b17bf1fe", "value": "31463680_D01_flat_31463680_D01_flat.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acb2afd-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846879, "uuid": "288a06a7-3a83-480d-a31c-4893ae40bae4", "comment": "Malware payload (Dridex)", "value": "4d8c00fa9b2be9ab82754a3e3e564488", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846879, "uuid": "a302669c-c7bc-4ac6-9c9f-11aefffa00ea", "comment": "Malware payload (Dridex)", "value": "047add592bf038dec9c866331d228540507d0a240e3c60c90a9b4034a0004129", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846879, "uuid": "3e15a37e-a7e1-4012-928d-3759f15dd002", "comment": "Malware payload (Dridex)", "value": "6b8f49321bddcd248419efbda27ac53c037e7733", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846879, "uuid": "972845a6-ad8a-4c9a-a2cd-c89c7c1add6a", "comment": "Malware payload (Dridex)", "value": "bf4e0b158aa038fe35f0784cce7dc4ead59f7d20a011b2d189ba34bf81401f00b3392906932057e5d0ced7e95d916758", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846879, "uuid": "e2a58ae0-9d37-42df-aabc-87686bf85bfc", "value": "64F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846879, "uuid": "c40590da-dc0a-46ae-bbc8-468f472d2143", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846879, "uuid": "bbce4abd-938f-48cb-801d-d68bfa89e94a", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846879, "uuid": "520ae0d8-29bd-4279-bd1a-76e81c79709c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846879, "uuid": "6787e5f4-f9ff-421a-af98-873340f6c406", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846879, "uuid": "f1d53aa9-4aa1-4673-a0b8-81811bb8665d", "value": "4d8c00fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2a0478-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621872542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872542, "uuid": "77b60568-d67a-45fe-836c-65a8ab15d0f4", "comment": "Malware payload (SnakeKeylogger)", "value": "ffc45506d785c2a2dc1d283599cc2df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872542, "uuid": "69afd456-45d3-4877-86bb-c60c9ccb92d0", "comment": "Malware payload (SnakeKeylogger)", "value": "04c6eca82081f7553126f32ca9fea262f99807920225f1d08ba30013ae4ff0e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872542, "uuid": "5e753c6b-6865-4893-9648-4cf7a3d59742", "comment": "Malware payload (SnakeKeylogger)", "value": "87daf9c76b0f36d0eed74ae947ffa23a1ef52109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872542, "uuid": "438b935e-bace-4000-a775-8488bd23db07", "comment": "Malware payload (SnakeKeylogger)", "value": "f52994c4cef469a330fc5045578754f23212a3c666634ecbf8acfd4383bceeb911f0dd1ebb06fbb0c947b06ae5184eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872542, "uuid": "82486eb5-de77-4911-91d7-1bed1ca98a28", "value": "A8159D2C516EF122C2ACC3BD4AD4443BE590D7377132BD29ECD757A85729E80B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872542, "uuid": "efd32b36-1447-4abf-863e-dc17562ee8e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872542, "uuid": "8018f3ab-3a51-46bc-9d58-655963b54b9d", "value": "24576:EBCGqL3PKpgztP5zGYJxvduw+LW1IderMCx:EBCGqjKpCtP1GYJxUf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872542, "uuid": "64fb8c01-fca2-42e1-8b22-23b7080c6b18", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872542, "uuid": "52f10b3d-f776-4fac-bf6f-099c049f2aa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872542, "uuid": "a8e1dcff-a181-4856-aca3-0764a1713f75", "value": "HBL WMS21050637 COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c007d3ec-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846941, "uuid": "5df4273a-ee30-487d-9d5b-58e770bceb7f", "comment": "Malware payload (Dridex)", "value": "b10f7c6411482bd4e42e8f6d25014d69", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846941, "uuid": "72b12448-fc11-40a9-9859-122bcb4303cc", "comment": "Malware payload (Dridex)", "value": "04ee8033456453064ac0bcf2d416c3a60fe1825618212cf5daa7fcb74588f6fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846941, "uuid": "79a2bfb3-9e4d-446d-8c01-716b30dca31c", "comment": "Malware payload (Dridex)", "value": "4eec12392298df5f14d2722962566ccf04b9f7ec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846941, "uuid": "7fa99af4-1658-4e84-92e3-511c65afb083", "comment": "Malware payload (Dridex)", "value": "b41b419c2f000b856b095dff33749af5a8609282e2503156b053502d15ae6123be880bd409d5fe1583b4bc312238a42a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846941, "uuid": "b10e9825-1c76-4540-a431-dd1f2def46f6", "value": "F6F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846941, "uuid": "66cb14bf-cd5a-45fe-959a-99fc39cfbdda", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846941, "uuid": "f77ab5ff-0412-4c46-bead-1525b5fbe2b2", "value": "3072:2iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:teAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846941, "uuid": "4c75c86a-334f-4526-89ad-53aa795227c5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846941, "uuid": "308664e9-ac6e-4354-b821-18cf8e6788e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846941, "uuid": "1739bd68-4ba1-4ae8-934e-92460de7f17a", "value": "b10f7c64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bd3aaf-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814522, "uuid": "eb28a919-328d-40ac-8215-860707f036c1", "comment": "Malware payload (Dridex)", "value": "db28d0fad539612edbcc838ff9a0303a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814522, "uuid": "81a0ddff-4747-40d2-ad8e-f4043e9cb45c", "comment": "Malware payload (Dridex)", "value": "050585b4c47b41e1b038d2a8022199b7c89e8008ba660f73e2836fab31701a60", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814522, "uuid": "d8d47abb-ac78-4a1e-8355-f121dfa1ca4a", "comment": "Malware payload (Dridex)", "value": "b1d5bc5cae996d6a806862cd8ea3e0247dffdcc2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814522, "uuid": "69da5b37-1550-444e-9105-0aa5f5a38fc3", "comment": "Malware payload (Dridex)", "value": "d21467bc60b78bbca89b9c78a104d65736c5ea88f871be8991101982334e855140ab1225e28adba7297f9c4cb075cbee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814522, "uuid": "52e52d3e-a6f9-4c58-a20e-7fbb8d368407", "value": "BEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814522, "uuid": "38300db8-249c-417a-bc3f-a1d909c6d62c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814522, "uuid": "66c2e276-4449-4b50-9f6b-8254a9a797e7", "value": "3072:Ulpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Ulo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814522, "uuid": "62fcc05c-794b-4445-8c64-e1308215d13f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814522, "uuid": "38dee2e5-3ed3-4c21-a425-84390c55fc20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814522, "uuid": "6eb5cd48-17f8-42a4-ae34-0987e3933bcc", "value": "db28d0fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a2cb1a-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1621872805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872805, "uuid": "4c9e1a05-7180-427a-9359-79ee1771d83f", "comment": "Malware payload (GuLoader)", "value": "064def890d185dd75c67eb3eba51d678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872805, "uuid": "535b880a-ff8a-41fa-8c13-4c36726ee8ee", "comment": "Malware payload (GuLoader)", "value": "0555ac95a40bd6c96d32c909b688da25534d09a514b4cc24a2b7a2ee6ce1b733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872805, "uuid": "722bb726-fee5-47bf-98e5-b0c9a11c1689", "comment": "Malware payload (GuLoader)", "value": "0013483bd8e709ed729e1b749183edf8cd5ee961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872805, "uuid": "b454ec84-8da2-4557-a85a-e2a53a732421", "comment": "Malware payload (GuLoader)", "value": "fc3dced342b996b128ac45168f281952f941884cb7851a46b4725ba3ebc2f68d5959893e7326c94d1799a2cf3919e217", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872805, "uuid": "cad0c15f-8811-427f-b25b-d487d9ba9576", "value": "1A4484B35D60DCCDEDA5CC3C453F8BA2DA44F8E1793A0636E5939B88F525D92A10331A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872805, "uuid": "a8c5b669-8f28-4d43-80f8-462cfc77fcad", "value": "55a503a3bd20df6ca8e85e03331a4fd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872805, "uuid": "06aca2bf-32e7-4b20-abad-f34ec3d7657d", "value": "1536:qWFg7aNMPFXJ2X/SNO+0RIe/9Pq0BZ8NfGOs8AWlniDRK3p/+:q/269rNOd/9y0X8NfGOs87nigd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872805, "uuid": "a6cb71c7-3173-48f6-9cc7-0e99aac31200", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872805, "uuid": "eaabfa03-714a-48d2-8b4b-5e2bfa03efb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872805, "uuid": "7c567cba-1ce2-4e47-a1f0-30cd11f786fc", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d13ecfd7-bca4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621870163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870163, "uuid": "a746bb62-7c8f-48f7-8009-98d59a7aadc2", "comment": "Malware payload (AgentTesla)", "value": "815669b94c0c31a271420c84247805b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870163, "uuid": "b08b3682-08ca-432a-869b-d4a8a0ea5c09", "comment": "Malware payload (AgentTesla)", "value": "059ad7163311e624a3dc91e3532c2c55f522cf36956bd8c21cdebcfd6295dcea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870163, "uuid": "df241a07-659a-42ce-abfd-54ff3353d583", "comment": "Malware payload (AgentTesla)", "value": "85126eefd03f6a80c094b4ccf0c6ccb82758ec83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870163, "uuid": "6ffd539f-3b9f-4962-948c-70d6491136f7", "comment": "Malware payload (AgentTesla)", "value": "19b8059491effc13591752f7c8d044796f01d6a2a1fe8524a9cfb16f3d54b6a09b0df89e254786970c0ee7c1a994ade5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870163, "uuid": "c26df2b3-aab0-4557-b6ae-67019298648a", "value": "59813B7DB6793CF5EF7641A7D738FAAD02F2328215CB14C979EC5A01072A319C9220A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870163, "uuid": "77c14861-6d29-42c4-95ce-441a66bc76e0", "value": "96:ePenoGgFOwZxTiQ8ALiyc1F5wdXBGdFyrmVK1JOHM:ePJZZcQzLs1Ydukrmk1os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870163, "uuid": "99bd2775-1bbe-4066-92cb-8d1d86f207c2", "value": 4029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870163, "uuid": "284ceed1-703b-4d77-a5df-0ae3e9bdce25", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870163, "uuid": "a78e5df6-8fca-415d-a7f8-49bce06350e2", "value": "Purchase Order 4500412516.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea5bbc0-bcb8-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621878776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878776, "uuid": "d97b5f7c-f697-48a0-b50b-bf616c05a67c", "comment": "Malware payload (NanoCore)", "value": "2c25930da215dccac6d3d3c18860e2f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878776, "uuid": "b43b3ffe-ee1b-4f2b-96f2-692660124c8d", "comment": "Malware payload (NanoCore)", "value": "065f50e43b6331130a7b0ac8de24f6e1df0fb00d5c101666f32f6d54e6bd9d83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878776, "uuid": "8ad78390-9629-423a-bd5f-a637acd70c31", "comment": "Malware payload (NanoCore)", "value": "7a60598b33ca31627ab3767c6359ce81f8938785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878776, "uuid": "28d1f95e-3848-495a-942b-493e2bf40431", "comment": "Malware payload (NanoCore)", "value": "4d0d2ecb6dd316a0d3c09ea523269d63c140b12e95b2f465ec4541597b4c2c0a31b5ed2791b6699da5c880596c1b7b0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878776, "uuid": "e8786cba-baf1-4dc3-89b8-4509e2b11bbc", "value": "36E42305F5D63C3BC1A297B85451F39AC9B3E72C861242E32BA95FD72C6D1C78126D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878776, "uuid": "47a16330-fd1c-4693-ba49-e34e5ad2f454", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878776, "uuid": "4dc489ab-8102-4f9e-8942-e7afd6df1cba", "value": "12288:Ft4EYRB2oYZH7Jr/x6mwxqVdMb76Cdqd+EuWBDTYHIC4jsSc:FtaRBnoxpdw4VdMycREFXoIKSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878776, "uuid": "31743897-b68d-411c-b204-966b87e7ba08", "value": 676285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878776, "uuid": "816def95-e60b-423d-b556-7691258d32bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878776, "uuid": "eb08bc7f-7d12-40d8-a15c-93a60c4fa1ac", "value": "2c25930da215dccac6d3d3c18860e2f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2729b5-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886561, "uuid": "d57afdb0-fc1f-4a71-8a77-2428de09699a", "comment": "Malware payload (Dridex)", "value": "bbe499efcf1356097ba967f787b5ffc8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886561, "uuid": "e9d0e24d-52d2-40f2-9c9b-44b72a9bd18f", "comment": "Malware payload (Dridex)", "value": "066fc034bd3ff07a4d24d60e71f2e1df4021aaa7716b609dc0fb7be3f37d9a26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886561, "uuid": "071e8e1a-12b4-47e6-bcad-ef1e44c7919b", "comment": "Malware payload (Dridex)", "value": "8c3e6f0ff38000b01cc75abe9ef9813ccb69fb86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886561, "uuid": "8a144e93-4295-4c03-a5cd-de6402f7e5df", "comment": "Malware payload (Dridex)", "value": "e2ffad6c4b8c94af2f09c5d7378f514dff3f880d323ce7f2f897e11c07a2a0a7ae0b6bc7d15cbea8da6bf1af735648b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886561, "uuid": "f76ef26f-9aa2-49ba-896a-b1c0be06ddf3", "value": "6DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886561, "uuid": "192a8b30-d23b-466f-a63f-ad1d97cc2f60", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886561, "uuid": "da57aa36-0ea2-4881-944d-adf4378fcc41", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886561, "uuid": "42e73e7e-4e28-4e9a-88db-a360a1db990b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886561, "uuid": "4ff5bb60-15b3-48ca-aab2-6114845dcc35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886561, "uuid": "63c3cf1a-5aad-462a-bbea-455ef187a66f", "value": "bbe499ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9f7bd79-bc5b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838851, "uuid": "277d262a-da55-408c-a333-1f28f8de81b0", "comment": "Malware payload (AgentTesla)", "value": "4b564083a2db7f7a8c30fa226c366e6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838851, "uuid": "4622b79e-0ce3-4eba-b57b-d82f956b890e", "comment": "Malware payload (AgentTesla)", "value": "0681e69745fd994fa5b22b52069293ec3faa886943e358fbda87dc20b9c3f395", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838851, "uuid": "d4659fc1-bf31-4ab3-b9ca-3bff2fbe7642", "comment": "Malware payload (AgentTesla)", "value": "2bd71eb9e6f1c3e1db4473f56dc10aaf75a37553", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838851, "uuid": "1681b37b-03bf-4648-8c4f-b2b2611ce3e0", "comment": "Malware payload (AgentTesla)", "value": "f4a833673e9f4449f1c7ea40c543a4d251f5a11c735338625a140053e7bc435854f28c004eeafa1d56f35a36db739d4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838851, "uuid": "e96d48ee-f001-46e7-aa05-8bd7e99d7b8b", "value": "A5E433A4A0247983756DF09C29A161A198B5C446B3E0DFD8CFCDEA5BC7D3482D6EF309", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838851, "uuid": "6b5f2337-b994-4455-b0d2-e356558c5caa", "value": "12288:XQgwIwNnTnyzstLBQt08O1H6IobzQsfiW/5lDQ/tYhCBxrnrPTp3PbQixi+v1wU:XQggnTTWm8CobzNiW/UDBxrnr9UyJ1wU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838851, "uuid": "b93bbfdf-b3ed-4cdc-99cb-415035c91e25", "value": 666875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838851, "uuid": "944fcfb4-1c99-48ad-bbaf-860a6c6e9e0f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838851, "uuid": "b1c26804-2568-4fd8-9103-f47fd88c9e1f", "value": "JESCO RFQ (PR21001312).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd67efb-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879335, "uuid": "eeb3a261-9192-4b0b-9f96-d54eaac0dfab", "comment": "Malware payload (Dridex)", "value": "c90ed6680cc81a2aa57b96a5c333c8ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879335, "uuid": "0c4b3f96-2501-4a0b-8769-2a337d8dd5a5", "comment": "Malware payload (Dridex)", "value": "0722ce2bd789bdc8f0b03f59443da0019e6a5e65a6bebc49cae8432f96cc22a5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879335, "uuid": "3b7523c2-fe6c-4511-9112-3ae51a9d4db5", "comment": "Malware payload (Dridex)", "value": "73206500598ada72abda91dec76d1b1c13022e6c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879335, "uuid": "fd31b7da-1202-4128-8644-9821adcb1426", "comment": "Malware payload (Dridex)", "value": "2f4e0aa9a6d86480cbf11dab3d86e748e57c23792ec30d19798b00af5ce0c335d6433772e0747ba5dd52846b7e36f075", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879335, "uuid": "e7285b35-159f-4b81-8d3f-ca6f30a3f885", "value": "F7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879335, "uuid": "b551416f-9de6-430c-91f8-2d7f1e376cbb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879335, "uuid": "5bc225ad-9395-4350-917c-b0b87c4246a7", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879335, "uuid": "5ee753e7-1868-4203-b609-773b6225530d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879335, "uuid": "0fc4dcbe-fb92-479d-97d6-3fa7931050f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879335, "uuid": "f43ec652-d6ad-4b00-8106-65e44eb165bd", "value": "c90ed668_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2ae352-bc99-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621865326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865326, "uuid": "5382e024-f656-4fbe-9c1d-95f4b06296ce", "comment": "Malware payload (SnakeKeylogger)", "value": "a902787faca146cd34cd08e2159f192d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865326, "uuid": "3fe8970f-967a-49cf-a1f7-1f0aa788ea6f", "comment": "Malware payload (SnakeKeylogger)", "value": "0761d1ae319f9d37dd09aa0498e978f1dd76ead29c2e4762f288483339928492", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865326, "uuid": "34d1e043-b361-4071-82d6-b9f445269eac", "comment": "Malware payload (SnakeKeylogger)", "value": "935f47d70ef655b67e5746e048726ca7952e806e", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865326, "uuid": "0ad7b758-4330-4297-bdcc-fc7aad0b95c1", "comment": "Malware payload (SnakeKeylogger)", "value": "80e3b17f565accb9e60be80e893122d605c9f98161fa83f01e331bb5aa5f12dc732ab4ec815865620b5a632deb542620", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865326, "uuid": "4b9f83ef-7532-48e5-8be3-8510fa5b66ce", "value": "05C4237095456A7E86D0C0BC097105F88A07F2D825B9E9EE337BCE49E7C4AB74D22237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865326, "uuid": "dfa476d9-dc76-40f1-bfb6-93c680fc8a1d", "value": "12288:d0UzM8x/0pJoL5CK8e1GgFYEIFm1cJsS1spX0s1ZVi:WKxgk5C2GiLeMusS1spNHVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865326, "uuid": "7fa75e92-6a89-4f95-95de-551fc9255bd2", "value": 550374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865326, "uuid": "d4a16d64-69c0-4c4a-9b21-48b26425652d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865326, "uuid": "c9695428-4e2a-496b-8dc4-d1fa9a9a3b87", "value": "WDMFT505_BL_VNHPH01_NTTQUYNH_0520_000018_040BA05287-MAIL.PDF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be35a1a-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871335, "uuid": "75089e9b-28f3-4f90-af0d-fa4de7c988b6", "comment": "Malware payload (AgentTesla)", "value": "4d33d6288751d5f8e69e23be41220b12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871335, "uuid": "60f8f55d-d4e2-40c3-a63d-d3510f54a2a6", "comment": "Malware payload (AgentTesla)", "value": "0862accb403349f37941cc6f8c3cf104bed79dc2b1b1874e397a9b624292ace4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871335, "uuid": "71bb411a-6410-4977-a318-b865c079679b", "comment": "Malware payload (AgentTesla)", "value": "bb69639a78c85b3c6c3e4562b3e967e162a2512e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871335, "uuid": "2fc101ab-0c02-4188-ad76-67f8a6f5b926", "comment": "Malware payload (AgentTesla)", "value": "a49ddb8ea2c18344ec7f67704296fe13ac41b8c5cffa283e8c721c5e01e8c0874c3d7d3818a8a48af0efbdd7cc2e20bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871335, "uuid": "19fff06a-76f7-4e2d-a818-af0e0698b8e0", "value": "E845F52DA206E080F15DD071CAD0AAF7D402EF3BDA262D1795C73F81723AE563A7615E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871335, "uuid": "c0c2b067-53a6-4db2-bf21-3a7ed604be37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871335, "uuid": "9abdc106-5764-4a8b-a108-70af71bb759f", "value": "24576:hBC5YarPMQAjUSqrpM8wZ118cAtaJ/aqgeplZTmhJ8OTKT:hBC5YarPt2USqr42cAtW/fZoJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871335, "uuid": "15e11b0e-0f2f-499a-9018-581a6e20de6a", "value": 1180672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871335, "uuid": "7282e315-2bd0-4ee0-8cc0-156c47f71f75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871335, "uuid": "bee1b256-d04a-4ebf-9fd2-b029eccd7611", "value": "BL-DRAFTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930ea870-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864905, "uuid": "71488853-e9c5-45cb-8297-9bab153d0056", "comment": "Malware payload (Dridex)", "value": "449c0ed3bb1693cc44751040235041a4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864905, "uuid": "8699e9db-5795-489a-98eb-dfc8306e92c3", "comment": "Malware payload (Dridex)", "value": "08f9302c8313abf5e56115dcdf2909d54c7ceeffc198b4674b4bb64bcaa9933f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864905, "uuid": "5ff5a0cb-3906-489b-9cf7-83f5c70ca835", "comment": "Malware payload (Dridex)", "value": "452bbf1e803aa0fe225dad894d9ac564669d51a5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864905, "uuid": "ddefc0f0-0f8d-421e-9962-6e78d7ff6dab", "comment": "Malware payload (Dridex)", "value": "139da609ebcff56e8e110bf3b049b50b89fcd9c6802efe36453362e5d28260ffa2083f2dbd48bcb6919178b0d3997dda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864905, "uuid": "09ce1339-6b7b-4475-89ea-36c2c477821a", "value": "DDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864905, "uuid": "8228a63a-1c79-46e8-b438-d98388beaefc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864905, "uuid": "0e73c09c-d17b-4b58-b35f-31e4f8f62cfa", "value": "3072:pmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:4Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864905, "uuid": "c8288a39-f1ef-44aa-97fb-e2c68f487d6c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864905, "uuid": "daf03c1d-f986-4502-9526-baf19b9588e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864905, "uuid": "b6aa3f7f-7068-4022-9196-3d673ba8b209", "value": "449c0ed3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d6cbbb-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872135, "uuid": "cc5702a3-bf1b-4bce-93c6-6805603ec041", "comment": "Malware payload (Formbook)", "value": "3334b4c93d369625c62c0dba8453a529", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872135, "uuid": "161a7096-f2c0-43bf-9efd-d0548937b5ee", "comment": "Malware payload (Formbook)", "value": "09405932ed587649990250670d78cb77ee99d974c65bcbf66666f9a14e3dfca6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872135, "uuid": "2bd6c2ad-9a3f-40e4-a983-26a2ef2bf0cc", "comment": "Malware payload (Formbook)", "value": "0537d03b3ee2c031801704edf474fe3fc3a4ceb6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872135, "uuid": "3a45da3a-b5e5-485f-a7ed-36dc8489aa12", "comment": "Malware payload (Formbook)", "value": "7a4b2a064a62264b7ef6ceb224261d097b1fa11dca5491efd2d77d30807b3ae7a9ea69cb2c2cb50dd793d996f425eb00", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872135, "uuid": "7743c43d-cf98-403f-a039-4b7e5e9e15bd", "value": "E135E21CA959A0B1F468C23505C37017ED99CF3BA021A9949AF7275F2F379C0BB4A1ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872135, "uuid": "b94a35ba-b167-48eb-90fb-55405e4cc59c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872135, "uuid": "14ab5ea6-3559-4c4c-b572-68c52ada2109", "value": "24576:F8tWHJV1OdSWxfo4FJv+94Dd0iQD6ZUKr:JWxJFJv+CWMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872135, "uuid": "b4c1717a-fb1b-4337-8e92-d612c8127348", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872135, "uuid": "52090282-766c-4dce-9230-8dd4c9e12728", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872135, "uuid": "716ff06e-7200-4605-bc10-1bff923922be", "value": "3334b4c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896241eb-bc52-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621834824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834824, "uuid": "8a3deadf-9d05-45fa-a038-a1513fc063d0", "comment": "Malware payload (AgentTesla)", "value": "d1900b639ad9e043b1fdf368da5db70a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834824, "uuid": "62f64ad5-51fb-467a-9934-73af7f45dcbe", "comment": "Malware payload (AgentTesla)", "value": "0951f2acee4b1466ac04f11c815dae1c4888cdf37646e32c6db154e05f6c0b10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834824, "uuid": "b1476002-210d-4314-b77a-c93345ac179e", "comment": "Malware payload (AgentTesla)", "value": "b1f16351d39cd3f4b58e6de61cb5b7d13750ae52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834824, "uuid": "074b7d5b-4f50-462d-ae17-3097a8bc89c6", "comment": "Malware payload (AgentTesla)", "value": "1184727fc0567fc161f781583826ac5b3a97330e09ba54f4c9c48d45bc2b98d7e014c5bb7d9d523222b493b3ba8f16aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834824, "uuid": "ab3539f4-1291-44ad-a9f3-06cbaf61019b", "value": "A1C42308F7433AC1F59E70449CC2ED54188E982C6AFC594C7A1CC692ED27A7418EBAF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834824, "uuid": "1d12860a-ae76-45bc-a357-cd7c982e2ccb", "value": "12288:TCq6AV6w932+yyxIy96iW7voaKbjEj45eCMT7L/0v1GvUj6RIQZNcOVk3p:TCq6g6hRuhtCoaK2CU76DOPcwAp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834824, "uuid": "cf7ae903-f676-4adc-aa86-bed967d76525", "value": 596366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834824, "uuid": "ae05d345-d301-484a-a735-254dee5d89be", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834824, "uuid": "1b79671b-7de0-4d4f-bdc7-204d3cd89664", "value": "new purchase order.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8d4b85-bc38-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621823743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823743, "uuid": "2654dbaa-1274-414c-a373-5799736bdd08", "comment": "Malware payload (Loki)", "value": "43d58f1e8eb7f60d03062dbf141fd969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823743, "uuid": "ccf5080d-f946-46a3-9c26-fbcfbe01b83e", "comment": "Malware payload (Loki)", "value": "09f14a1a8cf75bd14aa1f480185df92f921cd241159ec4ae7bdbbfca3e52d453", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823743, "uuid": "a691a047-52b8-422e-a4a5-70bc1100fcb9", "comment": "Malware payload (Loki)", "value": "3805ec021608664fe974eea3094becb393c74a51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823743, "uuid": "10ab549b-e0d1-4bd7-8031-b11f665c5c57", "comment": "Malware payload (Loki)", "value": "34e68762ced109675b5366dc0e00bdddaa0919703cd127a0e5dc9b2e0d79069acb4659f3ffd8f0b606d503fe200b09c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823743, "uuid": "f82bc0f4-54d5-466e-9e62-d1f08731c4a3", "value": "6225C01CA169A132F568C27901D37127ED18CB736021AD54AAF70B5F2F37EC0BB4A5AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823743, "uuid": "7eb8c0ee-c016-46e3-9984-f9120de4d0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823743, "uuid": "0e432c2d-2bec-4c6d-af20-c3dd887083c6", "value": "12288:yyBfcVOlfkrzVxmcZ7pVx+fnc8FwHipgr9br2aZ2Dvl1vymj5oV:yyBdl8rthoc8FrgFJszamjy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621823743, "uuid": "25113993-52ec-4f76-9cc4-073f7f105fba", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621823743, "uuid": "c12347f9-1a55-46de-80f2-52461b9931ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823743, "uuid": "0bcdb03e-e01f-422b-a2a5-b6834753a32a", "value": "PaymentSlip0100pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2397917-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821685, "uuid": "d39c2a02-0eaa-4747-8e60-3f5a5917458d", "comment": "Malware payload (Dridex)", "value": "554a54b009ebd47c1560625b61c63757", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821685, "uuid": "c9c5ce89-b630-4118-8411-cd9927ef7714", "comment": "Malware payload (Dridex)", "value": "09f8f9cc5a6c21f5c47ecb6c49dc3e4b7698f9e15e584be78d4b93514f0d6624", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821685, "uuid": "a0c1d0af-0bcc-40d7-a519-16970720a6ed", "comment": "Malware payload (Dridex)", "value": "04bd04fd2a8d27c89395504c5ee432759259e350", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821685, "uuid": "1f11146b-7abc-4cbe-ad9b-830ce64d791f", "comment": "Malware payload (Dridex)", "value": "272e9d77780a11ef54e0f6378b76029144142f3dcf0c5dd7d20e4ce06d208bc18d7f027ecbcbd972042d4fd1117e43fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821685, "uuid": "b13ea320-75c3-47a4-a247-ff80cb81936a", "value": "A204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821685, "uuid": "48cdeed5-db1c-4649-b2ae-f23a31595f67", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821685, "uuid": "6192bab1-1e38-4420-8e9d-bd85b39425c8", "value": "3072:DWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:DWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821685, "uuid": "f504533a-ed97-435e-b424-0afce5186d0e", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821685, "uuid": "bf035136-22b5-4325-b059-634eeb102900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821685, "uuid": "31344ad9-e0ce-4138-977a-14190a409e65", "value": "554a54b0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab652a8c-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621837887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837887, "uuid": "1310816c-320a-4ac9-a538-9756ccfee79f", "comment": "Malware payload (RaccoonStealer)", "value": "7602247a18ab173245904dac3b55dd23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837887, "uuid": "70657e5e-cdfd-478d-8ed8-8953ac03d0a3", "comment": "Malware payload (RaccoonStealer)", "value": "0a34ce70a86a90417435832c4c2c5c0756337bb399014aa31e43323b1dd4166c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837887, "uuid": "1e52ec4a-70e5-4107-9e04-176a8544c4cf", "comment": "Malware payload (RaccoonStealer)", "value": "1be49659fa628b04f087b525e8719e8352926463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837887, "uuid": "17396811-c68d-450d-bedf-bd928c82aeb2", "comment": "Malware payload (RaccoonStealer)", "value": "b188066e595176cfa2e935fdc19dca835f3b1e1171858b731f98509d5711b8c9614e31e8ff04344a79775096d6869aad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837887, "uuid": "b0e2c5b0-cca3-4490-a46e-28d9978fca05", "value": "4EC4DF30A6A1C035E4BF13B449B582B8653A7DA06BF490FB72D23ADD5A309E49D3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837887, "uuid": "261e5eaa-73b3-444d-ae34-f21b3975c99f", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837887, "uuid": "38978c33-2658-4d4e-af85-01262c5d6d19", "value": "12288:NmqSeOJ45Gxvf6tI1LeDCvh4MVE5uwvFwW7Lx0XsL:yeYfVlb7E5uwOYLiXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837887, "uuid": "03a7376b-197e-4a9b-af06-43148a5c36b3", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837887, "uuid": "832fea8e-f381-434d-9114-13aa70b6d814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837887, "uuid": "6950d29e-84e1-45d7-a234-4bd588b965f7", "value": "7602247a18ab173245904dac3b55dd23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e7ada3-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818034, "uuid": "017176f2-1200-4cd3-b391-05cd6cf03f35", "comment": "Malware payload (Dridex)", "value": "4feb353c001ef0c221378f4234f2915f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818034, "uuid": "77edc3de-6468-428f-8fab-a04a8f956309", "comment": "Malware payload (Dridex)", "value": "0a38f68350eb5bc9de1194d33c02344aba2f6fa4961ad9740aa66f70fb2bba7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818034, "uuid": "bfa60183-30a1-422c-ba26-9fa42f1a05c2", "comment": "Malware payload (Dridex)", "value": "73c3b4d621bb3e7ed9538727c29b771859dd21ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818034, "uuid": "d79aba11-4a55-4227-b17c-38e6f121972a", "comment": "Malware payload (Dridex)", "value": "3eee35004ebd5576966d268fcce24a0542a2917b46776d7103250b687412b44d3bee329159b41de53493a7b3efb744f2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818034, "uuid": "80e6a02c-a982-4d07-949d-54bb5db81edd", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818034, "uuid": "20272056-17a1-44a2-905c-c817fa98aa6f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818034, "uuid": "3dcf02a5-c7b0-4081-9f82-6ea9aada4542", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818034, "uuid": "16a228fb-3ca7-421d-a05a-502e81815c7b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818034, "uuid": "3d6d1a0f-1e31-4a2a-8fc3-3a7ccb7f6344", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818034, "uuid": "298c8915-5dd3-4808-abf3-0404fd535db7", "value": "4feb353c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf938b9-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825327, "uuid": "9c27c4a4-d1d5-4436-a8c0-4e0f5f113156", "comment": "Malware payload (Dridex)", "value": "7979cfd311fcf4499f95c668b7df6108", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825327, "uuid": "b90b80a5-b19f-42e9-ad1f-b8c8c28e1212", "comment": "Malware payload (Dridex)", "value": "0a7e3051fbd498386faeb33365fb0d25679ac4ccd9250cd42a9bfb8998c203b7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825327, "uuid": "d68683e1-2931-45a4-8acb-a950fea782f5", "comment": "Malware payload (Dridex)", "value": "ee961dfe1cb23f8819b2c3fe82ab1ba8b8715e00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825327, "uuid": "8d41347c-c30c-4bbe-91f7-a17135c95424", "comment": "Malware payload (Dridex)", "value": "cf4d57862e841ed31cbd8e50f28ea67a847dadcf543154ce1befe1258e3b7a6555961f040e143d9409b8fec29520b230", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825327, "uuid": "163febdc-15ff-46f5-a68b-4c4f0d088999", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825327, "uuid": "ab8cff4a-fbf6-4afe-bb49-0756cb6de28f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825327, "uuid": "ce5c287e-243c-4fba-90b8-77ddb69d6668", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825327, "uuid": "653c5371-4abd-432b-a135-52b51a1389b2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825327, "uuid": "cb210f99-0bd2-46ae-a671-01769fce4dd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825327, "uuid": "f03a5ad9-9efe-4485-b377-027c8a55cf8f", "value": "7979cfd3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9058ec38-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836124, "uuid": "7ac93ac9-c35f-4ea9-bb2a-dca7a3cafa2c", "comment": "Malware payload (Dridex)", "value": "d7af573259d4e2bee103b2732b9c9252", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836124, "uuid": "ebf35001-3106-4b26-a6ac-a1099567def9", "comment": "Malware payload (Dridex)", "value": "0a9c14f1554b6b6f9b60b7981160ec7402df09d1dc2ca6163b874eb989b7573a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836124, "uuid": "7d7b5ce0-9e6c-4fbd-97e6-5afbf68b9ff3", "comment": "Malware payload (Dridex)", "value": "5f3625d6deac1a913c99db634e710b38b76cdda9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836124, "uuid": "7619184c-f215-4644-9f37-04cf02deebfa", "comment": "Malware payload (Dridex)", "value": "9c07cae0a4e2aaf6a7851b113108820cce58de1577e67fab0815490883e50355c7c1207d2dd72722884c55c0d93afe4d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836124, "uuid": "5a7a945e-b837-46c1-88a0-6c1fac617715", "value": "FFF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836124, "uuid": "aeab0186-69c0-4077-b449-44482463df26", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836124, "uuid": "0fed3a35-6d29-452f-9c5d-c0f86b24a4c9", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836124, "uuid": "1ecd094e-87ba-47d3-a209-ddaea7bdd6cc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836124, "uuid": "0ecb98e5-1d32-4dc5-a3ff-dc8da33fc582", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836124, "uuid": "ebb37bc8-175c-4fe8-b7f3-16f35c6a03c8", "value": "d7af5732_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb91f35-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871288, "uuid": "af1b1d24-c450-4175-b860-c92768162f32", "comment": "Malware payload (AgentTesla)", "value": "a401dcd7fd17d96c794fa4a833e0b9d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871288, "uuid": "7683aa0c-28e9-45a0-b964-baf0f298e9fc", "comment": "Malware payload (AgentTesla)", "value": "0ac880479686bf1f37d20be85a0c2ddd76ba853942b40a9a2ba0f50ab9f24a70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871288, "uuid": "49193576-11df-4992-b94b-205b4767c289", "comment": "Malware payload (AgentTesla)", "value": "35f9a6918014b0e5ff7635d3f7d71dfee4174491", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871288, "uuid": "e92b4ae4-eeac-4ad6-8c93-bac3882bdd2e", "comment": "Malware payload (AgentTesla)", "value": "ca4add3ec27ebfcf5c4846e969374097e881dda62e2e3d8ca8d0743e1b96289a313940c8fe2c63d6fd1d255e8a746ac5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871288, "uuid": "45182cd5-5fda-4206-9827-e2b324969ede", "value": "67159CA077B15FA5E43643F1501252930B327D6EE86FC19A1DC278CB1EB9B4249DABC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871288, "uuid": "10c7d53f-56af-4b41-b25c-728dcae59f47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871288, "uuid": "69488e9d-e570-4e46-8a83-b783ff9720ff", "value": "24576:C2DoH0qwR0mYpfTEbD3yd2OluON4fA9uC:CpJwRlGYn3yd2OluON4fA9u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871288, "uuid": "86c6d333-d483-4f93-8214-32c565235b1e", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871288, "uuid": "33133319-db23-434b-ad9e-dacb04d3983c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871288, "uuid": "28b45ebc-a1ef-4eec-a434-6d98978db551", "value": "PO#45388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e57ab3e-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890049, "uuid": "649fa99e-7e9c-4fa9-be74-bf2c5a0924c0", "comment": "Malware payload", "value": "b597b78d5e2d0ac2c31e0f167398357a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890049, "uuid": "dcd9cbf9-f5f7-48d9-9c6c-72a59c006d9b", "comment": "Malware payload", "value": "0b0535dbc436cbfedb78cd99f44d7e997dd259af72fec6662260738a29b49276", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890049, "uuid": "2f543dce-e6d0-4e96-b770-032d32f1ceb8", "comment": "Malware payload", "value": "d79b4d449bc41c653250fec860d342fb93ceeb1c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890049, "uuid": "46f3dc7c-7ebf-4f61-8ea0-8c240c78728b", "comment": "Malware payload", "value": "b52524f9dcac23fda884197c19c8b119934e7e8eebfe10f85bed7a851368150ab122a9165963ecf4a89f3347e170d499", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890049, "uuid": "81545d47-0c03-4b10-8440-f99c93489412", "value": "BCF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890049, "uuid": "ccaf8b86-1756-4370-ac28-5d9d1e467167", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890049, "uuid": "70ea50ff-1fe8-482a-8693-3ea8a5a4f4fe", "value": "3072:OA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:O3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890049, "uuid": "6e5c6647-721b-47e2-8754-77b03d33fa12", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890049, "uuid": "9db7459f-b650-4319-bdaa-9a40c3437352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890049, "uuid": "2d99be6e-422b-4521-a58b-67d7736c7bd6", "value": "b597b78d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ca0945-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1621870516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870516, "uuid": "a49e317e-f85c-4091-a584-1f81c3bb3ae7", "comment": "Malware payload (OskiStealer)", "value": "49d90f2054887245b40dbc7c2c5c2dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870516, "uuid": "07d28130-6987-46dd-81f7-a69df3a6340d", "comment": "Malware payload (OskiStealer)", "value": "0b41c6f5457183bdec7c0f5cf2ac2465ee441668d15bde95738be0ec4a95e1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870516, "uuid": "2f8bfeb6-dd8b-4513-8911-2f32ac7f988b", "comment": "Malware payload (OskiStealer)", "value": "94abd0f747fbe1937339e3d46f7293b656cd5585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870516, "uuid": "e5f81d9c-8c16-45d8-a607-d48ce761df81", "comment": "Malware payload (OskiStealer)", "value": "1fd98eda6ec2c0d52f0590222074c64de0df2ddef321557d22a32ef01cdea85c5addc1bd7fff4c3abb540a60b2486c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870516, "uuid": "ac8a85b9-1505-484f-9df8-67f2ba5787f0", "value": "27C1B31463E84336ECB3CF7969F7C25111B8BB024EA69F5C30E0022EAD21241EE72B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870516, "uuid": "f622d032-931a-4630-a7f8-24bd57e669e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870516, "uuid": "a45f2728-1c56-432d-86db-350cc6a257fc", "value": "48:6HubMhop/MbDLbwlXNMhxFJfZQbs2HK5EVBO51+n1SmDqBHe8wFzWyzlW9AcvaAj:2C/M48TZQb8WQKbDkg1gkLPzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870516, "uuid": "5ac5a16c-f656-4482-bb22-d8511e00754c", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870516, "uuid": "1ddfbf46-9ef3-4925-8125-498fd24e4638", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870516, "uuid": "a15b025f-7c2c-41e0-998b-c2f19ecead04", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df1a68f-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621836120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "aaa08d33-9c5d-491a-bfdf-f6acb0ffd693", "comment": "Malware payload (NanoCore)", "value": "c15d06e506d2d68488be58d346402952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "719cc5f0-2ee7-4485-a731-e9d49a71f165", "comment": "Malware payload (NanoCore)", "value": "0bc5e31fa6391174fbf5a1e15af9dbc795bd592366821fea11520304ed15634a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "9a65e017-4049-4b8d-8bfa-b85d220e458f", "comment": "Malware payload (NanoCore)", "value": "38031de0acfb172c3f523038f471888ebdbdcf8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "958ca0d2-592b-472c-a037-90e247d4ec3e", "comment": "Malware payload (NanoCore)", "value": "23b5de2d379b5d34048bd98a903bd553b9ceb70458507590169993e9c20f8747146588fc514727acc979e173d7d60e9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "f8efbb9b-3a41-42dc-b8dc-ee0834f2a0ea", "value": "8CF4E0A523FC8F54D03D87754824A0708BF1AC57DA2AE706BEEE72AA7F727411523702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "e4d8a71b-649f-46a8-9989-bb9f76e865e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "d427ff57-d52d-4da7-b1e1-c176bd6d6526", "value": "12288:Puu6U74cwgI7KzD0VaQ7ZoKGQejL4IoLSE/e0GPp1TC6jzMnhwSrgGeOkWqaloVe:wE7zQRSKGQejEIoTlGP3TC6sBeghEXjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836120, "uuid": "75c35254-7d55-487f-a85b-7fe463415649", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836120, "uuid": "87968ef4-2dc1-42f8-8c21-727243cbf8dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "2ffd1a18-187e-43c6-928b-7a7af456197e", "value": "SKMBT_C36017022513490.pdf (31K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0ad041-bcd4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621890775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890775, "uuid": "b0f06008-16b4-4dc1-89a0-e2ffdbad39a6", "comment": "Malware payload (Formbook)", "value": "1ec5607b1f7a5dfd617d9383d2ff20ed", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890775, "uuid": "e44a15e1-9227-414f-8965-751287842f13", "comment": "Malware payload (Formbook)", "value": "0c10d992f1f858550c524146c3d65d9cb417e1327e9b40b18132378fc225d930", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890775, "uuid": "c6431620-e7e5-4be2-b8a3-786bebcd68bc", "comment": "Malware payload (Formbook)", "value": "583293b26c6756633f4e974586ee38f655ca5c5d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890775, "uuid": "b4ef2c2c-25a1-4cdc-9927-0738f68ab540", "comment": "Malware payload (Formbook)", "value": "57a2ea6b8f15df0fb3f4e575bf543b9e50de54e3ca5f8149a0400c92a2aa1de8eb3aa0cc3ecab76d65fc2d2d65b20159", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890775, "uuid": "fa3666cc-b8e7-49b4-81f6-8ac3761184b7", "value": "A2A4E4CD49801A49EC123F3C02F68871416BBF5C7FB6A4DE4A9575923A33DD2A31AE4D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890775, "uuid": "4af6665f-41d3-409f-ad89-c49d9a564e38", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890775, "uuid": "f04b0f5d-041d-4e7b-9740-c92af8c6d501", "value": "3072:uQIURTXJlYaBrGMCtum3keIw52Hwp7ANbrC+zrBirro3n1ptgIQVAwK7EOCJ3F2J:us75+FVsEwBUrS1pOh1UERJI6UOmlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890775, "uuid": "55c3d7d7-acf1-42c0-a70f-01a40b92f851", "value": 486325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890775, "uuid": "0286d976-ee5e-462d-820b-fe59bd0bc20a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890775, "uuid": "9ecfa0a1-18b0-49ab-a067-a8fafee8892a", "value": "Produktkatalog2021_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7814a950-bc5b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838660, "uuid": "c8145cae-d4e1-42b5-8a50-2f035b69a349", "comment": "Malware payload (AgentTesla)", "value": "46971c033905d9af7b8943c6b1822bd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838660, "uuid": "fb05436f-52e2-407b-86c8-fd9f13db1ddd", "comment": "Malware payload (AgentTesla)", "value": "0c390d4ddd9d9767cfad8d1f13eb4be6ef59bac495e2821c0a50b9d33dc656a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838660, "uuid": "9efd1b2c-8f62-494d-a911-9c49e235149a", "comment": "Malware payload (AgentTesla)", "value": "bb66321f9293961ce9acec287af7f1262e8e05a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838660, "uuid": "7d0b5fcf-976a-44e0-99f0-21453618a6c9", "comment": "Malware payload (AgentTesla)", "value": "0ebe2a2a416034b4053a29e3803272fbf0af92c1ff06feeec47a444e0cfc3e5304dc0b633a4a0192e10fd99ab803a3fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838660, "uuid": "d1dcaaf3-86f4-4b54-bbc1-76723e6339b6", "value": "14B4126E2E9CF97BC5828EB14633C7EB99B2B8452F04427BB6403F7F59621C1A712153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838660, "uuid": "855fc8b8-461d-4fa7-acab-f1dd65d21720", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838660, "uuid": "a1d2e0be-3530-4f47-a2d3-71aa1fc20c43", "value": "6144:ksPU82SeuLlOjC4AAfGFhW8TGfNdOFw+tNaa2GLwI+Z7H7oRcohz3iHI3fxdho8w:A0BnA4mfN8ZtNag/+mRNGIvJL9RyX0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838660, "uuid": "17cf5e93-9333-40e7-9349-09dd7b42ff00", "value": 531829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838660, "uuid": "49433323-f77c-4d4a-88cc-5d8fa27595fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838660, "uuid": "83fc0929-8ad0-4639-af42-494cfd51a098", "value": "PO.CF004303.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44955b36-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621879376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879376, "uuid": "1222bc95-2e4d-48c5-bc0a-a9a13b0b82b6", "comment": "Malware payload (AgentTesla)", "value": "beef00c97a0a58806dac2cf5ddf60ed5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879376, "uuid": "78e3332a-e9a7-4621-ae9b-4757a3a7c825", "comment": "Malware payload (AgentTesla)", "value": "0c752b1324104b24b1a3cb86e8a8d32ee5c96352115d92eecc3fc21821554e35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879376, "uuid": "e6410d61-c0a7-4419-b01d-7f96dca8bea9", "comment": "Malware payload (AgentTesla)", "value": "cd5ffba6397ccd1e22e2eb810946847a0da1f6d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879376, "uuid": "9afb2b62-e464-4bcc-b59c-4914e8825f88", "comment": "Malware payload (AgentTesla)", "value": "2aee7cfef4ed1013ba9e0fa9ca7a08cd90b8ece3e5b0e0f3a95e417e9cecae8a6ccdaa8f96aad5f0e91e848b21f310ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879376, "uuid": "9729da42-3070-418e-a0d5-860d166f1d9e", "value": "96F433A8CF6F48EE07801C1D615FEAE4EA87BFD75878D0B8414BC7A2243599B7749072", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879376, "uuid": "490bd1dd-f8e9-4e9e-9a1a-b6226075c0dd", "value": "12288:RsvJQT0ea5TO/Ts/AcyM1Ti/8xH6Nz6VfEPHPNvAOYAvQYl5xFjcwxgNlAXGewBi:RsBQTC5TisvTr6l6CHPmOAYlfRcwxhwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879376, "uuid": "6657fa15-bba2-4eb9-b74d-c2a0c12091cf", "value": 737998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879376, "uuid": "329245b0-34e8-414c-8858-ab24463a2444", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879376, "uuid": "67f1b23f-ba30-4d19-9592-c0c08212830e", "value": "beef00c9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f575b-bcaf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621874616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874616, "uuid": "5830a0d0-2441-4c09-aa58-52c0e6bf2e81", "comment": "Malware payload (AgentTesla)", "value": "31dd0e800cbe022ed6aa1dd0e19ed7c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874616, "uuid": "3ca377ed-90e7-408a-a500-7c375a7ba0fa", "comment": "Malware payload (AgentTesla)", "value": "0d011a11f56bfb02dc45fc5784231377cdb06af659cb7416862e7f9240947d9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874616, "uuid": "1ccd59ef-ed06-40c3-b93f-5d0b8ad5e8a2", "comment": "Malware payload (AgentTesla)", "value": "4628c2f1b5b9eec067fbf4d4bbdd729d1b4c726b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874616, "uuid": "eec72775-6f6d-4717-a7ae-5905943b1fdc", "comment": "Malware payload (AgentTesla)", "value": "383119b11be9800e0f44fa7c1d8662bfd5d4b204fc64635877c18f6fc7aa3598d0f2bdad39d3860c65fe54044f5ead50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874616, "uuid": "da13dd22-c9e5-407a-9fad-ac3a7924cb17", "value": "B0158C2C612EF122C1A8C27A4AC5983BE451DF373031BD69ECD77B585739E81789227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874616, "uuid": "5e5af72f-1a93-46cf-bde8-832ece3d1107", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874616, "uuid": "18279ad4-bd06-400c-94da-6c2ca8d58786", "value": "12288:w7vy/tBsPZxj4UdhIAU2aEBV9I3Gb15DAZVkwrrSA/K0n/ga6AwH76ysz:GCbGxHPIF2F9pbDDAUuK0n4H7bWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621874616, "uuid": "04ec23a6-7b2c-4cae-9904-b99aefa4c474", "value": 945152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621874616, "uuid": "8ccfbb07-0991-4b0f-be5d-63db5fea45fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874616, "uuid": "763892b8-c440-41c6-9957-85f85e2f6730", "value": "Quaotation - DES 0468.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa659b1-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821726, "uuid": "4a3079ac-2244-47fd-bba8-ce878221f25f", "comment": "Malware payload (Dridex)", "value": "f7a472920346616908ff6bc6a56516ed", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821726, "uuid": "04816470-77b3-4937-b4b4-00c687ba4ced", "comment": "Malware payload (Dridex)", "value": "0d029a4374df9dece912cb55d64a360d97eab03de972d4f48ad22fd4bb732013", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821726, "uuid": "9b0d389a-ae0a-48ba-9735-37ef9e3c12bc", "comment": "Malware payload (Dridex)", "value": "f4417f206a7a3c260300e60a906df1c5224b17ff", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821726, "uuid": "eaa77af9-2314-4bd5-a13a-b41d3cf1d30f", "comment": "Malware payload (Dridex)", "value": "5a76c84ba043c8069a4ee5e063d0d536745b035bc7bac8505bf0c5088d288056731c311ae00a2685298f8027e137993e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821726, "uuid": "bc4d01ed-6172-4588-94ff-a16b6732eae0", "value": "B2F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821726, "uuid": "7168c369-ae4e-4217-8fdf-c5547ec571f9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821726, "uuid": "7b4d92d7-b4d6-4103-bdef-6a4795c9a8de", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821726, "uuid": "6333d112-3c5b-48aa-a09c-3e3c52288e82", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821726, "uuid": "bf71c40a-7b59-4011-bbf7-ad91230f3b53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821726, "uuid": "971f39d5-429b-4d55-9671-be08d82e3e73", "value": "f7a47292_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d51e2a3-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861352, "uuid": "5cfa0b99-4ecd-44c4-8372-826292b1b953", "comment": "Malware payload (Dridex)", "value": "1fe0595f86c3986775321e05a3a0b450", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861352, "uuid": "15219919-6c34-421e-939d-f71a8708bfa0", "comment": "Malware payload (Dridex)", "value": "0d1835e7e79082a014ffcbe9a499287425b0df671b4a674c28e8c5302cd30f8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861352, "uuid": "1a64ecdd-2ff5-4170-9449-af573bfb22a1", "comment": "Malware payload (Dridex)", "value": "b6a6717181153ed6fdf029dbe3bcd5db606a1350", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861352, "uuid": "70b8fe4d-9e34-4f6a-8c21-0c33536c0c99", "comment": "Malware payload (Dridex)", "value": "2161f1a33741921c1c3e9ea035b7c953bf24ae4c1bc1cb953ba9ab40b42e9a08ac4f87f796bc792c32d35f07c6317723", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861352, "uuid": "b9afe7ab-383c-4bf6-b82c-f2f9ca1ae8f3", "value": "EEF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861352, "uuid": "560fba75-1e6d-4904-b36e-944acf61a3f9", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861352, "uuid": "795c8780-db37-49f1-b8ae-d59764627230", "value": "3072:nA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:n3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861352, "uuid": "d08c1ad9-effa-439f-a7f4-0dc23e044c25", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861352, "uuid": "50483fa0-5d5e-4de7-b6ee-a7feecc41d7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861352, "uuid": "81fe20fc-deec-444d-aad0-804b5fadab2b", "value": "1fe0595f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa2b3dc-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843371, "uuid": "0ec24cfa-1892-44b1-914b-96dbaa555c20", "comment": "Malware payload (Dridex)", "value": "0ecad2803169668dc13254dab0cbacac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843371, "uuid": "75363155-87cd-4327-8c36-345a72740500", "comment": "Malware payload (Dridex)", "value": "0d3280d571ff90ec905dd9011ddb36f659345ab73ca109da29944ea7cef1144b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843371, "uuid": "bc3d3ad4-3fdc-452a-b875-a2672ba5b8e9", "comment": "Malware payload (Dridex)", "value": "edfcc7c23f9ad9396c55dcfc336ede59c5223d96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843371, "uuid": "cd430176-50be-47f0-a1ca-781a21a2a8c7", "comment": "Malware payload (Dridex)", "value": "14d0cf7e3d2fd193e95048a3a3c1ccb58fce0816bc90b5803fdb0a8a54b0b99c2c1bce14b8ba6bdb2aa9fd9efef136a1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843371, "uuid": "a54a0e69-e410-47be-bd91-9ec7f22aa9b3", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843371, "uuid": "54092b50-4f98-47f2-905f-2edf9575fc2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843371, "uuid": "ef09c253-45bb-486a-8904-0a3624c7c473", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843371, "uuid": "7b7b61bc-e1f2-4777-be17-dee641f963ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843371, "uuid": "d2fe66d1-af3c-427f-8da9-af18dfe0ff7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843371, "uuid": "9bca4319-1614-4ada-b82e-cad7a3e80b75", "value": "0ecad280_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65826130-bc8f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621860963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860963, "uuid": "bada7b58-b488-4f72-a061-33eb11463ba6", "comment": "Malware payload (AgentTesla)", "value": "46e4f4a365dcd597e0b79fefdf29c557", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860963, "uuid": "cfd55205-73c6-41e8-94cc-0e0f5de22acd", "comment": "Malware payload (AgentTesla)", "value": "0d3cb97dc52cc9b730a6d0a17cd2d4d7af57feefec9f8865862c291369c31216", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860963, "uuid": "a52bb1ab-e65a-4776-b10d-e588594e716d", "comment": "Malware payload (AgentTesla)", "value": "acad986d606b805862bf2c14320a9b256c4f6e0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860963, "uuid": "5866e366-0249-4723-9f19-42a8add299f4", "comment": "Malware payload (AgentTesla)", "value": "26c69403d9f5fbcfc2d5e9f3972724931d2639efeef30c9753ca4f7cb81e5a49fee6a9934c2988d6a45f644314cb3b88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860963, "uuid": "1df4f027-85d5-464b-9970-7fda2adae401", "value": "2B357D6AE342D0C4F65E24B1CDA0FBF00557FC6BCA0A6E4711563ED2707BAA75A3A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860963, "uuid": "3a527493-df72-4ada-9107-69ebb9f2916b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860963, "uuid": "0e526310-8fe0-4641-a634-22423ca9a976", "value": "24576:p/hvnkNgS1/0ZH/K0OaXavaLY0nzT3aY0:p/hPi1efKv0sqzT3aY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860963, "uuid": "d0a2c040-ce0c-4bce-b357-f1e24a40a438", "value": 1144320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860963, "uuid": "10cba94b-ef8a-484d-8983-423b56215541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860963, "uuid": "ba34361e-8744-43fa-ba36-14756df435fb", "value": "order confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf36eb8-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893642, "uuid": "93ea9d92-65da-4834-9d81-58e07ae01ce2", "comment": "Malware payload", "value": "c3a06c61d2768f40871c46b8818fa1d2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893642, "uuid": "deef4f13-33b4-4d9f-b6d9-e97e5461be7d", "comment": "Malware payload", "value": "0dc561266a63197b92b6db0f62d37bdb81fa907d66aca1fb129472961444b72c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893642, "uuid": "2a06ab28-bd24-4f7a-a37d-084c2dcf6587", "comment": "Malware payload", "value": "dec66da70fd81cec97b1f5acb4392f72b9c59e39", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893642, "uuid": "dc856efa-1907-4fea-8125-53a02b9ba68c", "comment": "Malware payload", "value": "b4bb84753692688604207b32e7b7ffac7a059682950350f313a694888932c0e8eec687e07de9ccad970c901853d3e435", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893642, "uuid": "ee43156e-32e3-42e9-b223-ee441a4d13ad", "value": "07F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893642, "uuid": "3a207431-ffc7-47ab-b32d-a76b980053ea", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893642, "uuid": "aa7f590e-522f-46c2-9ee6-18d45ac5e2d6", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893642, "uuid": "a4e05c5d-91d9-44d0-9dc0-9ba0da988f4b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893642, "uuid": "062f032f-e438-4fea-9589-7609ac653a12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893642, "uuid": "96c383b0-a44c-4d52-8480-fd9d4ba9d135", "value": "c3a06c61_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0fd521-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882959, "uuid": "e887cdf3-6cef-4ab1-af95-81d76d998517", "comment": "Malware payload (Dridex)", "value": "be44b7d181ae156ee0fb129eb69c7df6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882959, "uuid": "638bd6a4-0c33-45bb-ad9d-4c6429df600a", "comment": "Malware payload (Dridex)", "value": "0dcf43e77e6f14ac1ed91c486ced215c98a98672299832afc327f5711254d584", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882959, "uuid": "962e9492-adfa-4867-a5a1-6b725f72af57", "comment": "Malware payload (Dridex)", "value": "79a44fbc2c464e3a27b900bea5e52ca44e1c80c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882959, "uuid": "78fdf671-b54d-4fa0-b525-c7af54147466", "comment": "Malware payload (Dridex)", "value": "e8aaf89bd776d317bf03b27807a6527a2fd315f52aa4679783aeee2e64e3861f3f2fb3cc424587914791a67dc5b6914b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882959, "uuid": "60c62c41-e31a-405a-87b2-d0d56353e046", "value": "F3F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882959, "uuid": "c0d92ba1-493a-4c4a-b6fa-d1ce17e4b41e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882959, "uuid": "71e9191c-d2ec-45c0-ae3c-461863890b77", "value": "3072:qiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:peAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882959, "uuid": "4b0525dd-1017-404f-b3d9-cb4667d149a2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882959, "uuid": "50524a8d-566f-4a98-ac83-5ecc0cc80201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882959, "uuid": "24c2c677-3e0e-418c-8f70-83ced30bbf3b", "value": "be44b7d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1160c14-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821630, "uuid": "e706bde2-a7af-41df-bd43-60fb8d1c9740", "comment": "Malware payload (Dridex)", "value": "dabbe36aa0c1b426e473daaf05ea3c14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821630, "uuid": "44f0ee37-eeea-4245-849b-b64139cd166c", "comment": "Malware payload (Dridex)", "value": "0e21b6720e790c190d1d7b4a9c0efafdaf42b72067f138a0b4fc495f5f0b2b31", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821630, "uuid": "917ae124-4b88-4f6b-92b5-623793b214b5", "comment": "Malware payload (Dridex)", "value": "795c7a46e9cc9e24adcdd52ca936b9cfc3e9e0dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821630, "uuid": "46cda134-61bd-4608-b166-565b9cde64fc", "comment": "Malware payload (Dridex)", "value": "e190a01af31030e7e27cc1edb067a1e4b526c43447206056d255d9a95e49a68bc9fc56ec4505c6a3470bd1546512fdae", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821630, "uuid": "0a648b63-d625-4cd1-8b01-00dbb8a26051", "value": "92F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821630, "uuid": "15af3588-b9bc-4efc-b7ca-714a0e94ae20", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821630, "uuid": "df538962-020f-4d81-8a25-77a1ddc78642", "value": "3072:GiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:9eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821630, "uuid": "e5b75f2f-3f7d-4575-8425-89de25552c8f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821630, "uuid": "294b1e2d-8091-488a-aa0b-64a634ecad82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821630, "uuid": "04411bb1-4940-4562-9709-0e9ceb3bac92", "value": "dabbe36a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088b7e6f-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850499, "uuid": "e97c31f1-8eb9-41f9-90ce-f0477f046a3d", "comment": "Malware payload (Dridex)", "value": "3a5b369163dc8b6f15ce341084a58884", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850499, "uuid": "08f8e27f-a112-4d99-8feb-2add1bc8d22f", "comment": "Malware payload (Dridex)", "value": "0e7a3df1043157cff87fa769350e9c1243808860817f2b87a3d326c527aefc2c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850499, "uuid": "a73c63ff-8a0e-4f3d-b091-bf8c2365feeb", "comment": "Malware payload (Dridex)", "value": "8445e8c2da1045aa06a327a4fb43c88e926dd4e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850499, "uuid": "664bea02-0371-471b-abf7-0a364174c0d8", "comment": "Malware payload (Dridex)", "value": "62efa643047e034ecbc4569903f92fbe8c69739779c284c5066f07d59b2305a3777bac8b6148f4a2dd8b94681b88ac3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850499, "uuid": "883b9cef-f931-4da8-871f-030d685cc73a", "value": "78F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850499, "uuid": "cd0d0b84-2ee3-4c58-bae8-f0b27ad57a00", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850499, "uuid": "c92da930-b0bd-434b-a68b-84578bb1925b", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850499, "uuid": "b563d587-42a5-401c-91b0-b6146be34afc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850499, "uuid": "e050541f-2fd7-4d29-b4b7-c4a81d8dd413", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850499, "uuid": "06c2daf9-1c5a-4508-9cca-bc70d90f345e", "value": "3a5b3691_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10157fed-bc78-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850941, "uuid": "c9e1a952-e68b-473d-8b1b-0c3b49184f82", "comment": "Malware payload (AgentTesla)", "value": "d81f0c52416539a5ca6c5ae74b8450c6", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850941, "uuid": "892f7c3a-1cd7-413c-9cb8-11ed46506f61", "comment": "Malware payload (AgentTesla)", "value": "0e935a97c2ba17add2d1bece5d42ab590d65af004852c0c6d5a29a9d859e569d", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850941, "uuid": "07682eda-1a7b-4426-a5f1-7292421d8d4c", "comment": "Malware payload (AgentTesla)", "value": "488fede94c282cf4370a96c7234e58162c134596", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850941, "uuid": "81567185-b883-47a9-9cfd-05fbe3a48472", "comment": "Malware payload (AgentTesla)", "value": "385ceed14ded1fefd01ce9c3e3a40ef84dff897bf3bbfe4d6bec5bed066dd1116053912dd6e2779972e7ac74a28d65ec", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850941, "uuid": "1f932c95-682e-436e-a10b-8be4a7674613", "value": "CAB423C09848C860E11667F0DA96BB49D7DF12F0F15EABEE36631CF32A33556E420867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850941, "uuid": "e30a9278-b518-4fdf-bb9a-54aacdcf3af1", "value": "12288:vhfiQGV53GV//pN5RM2eZEHR4k5sSRe/5P8bqQro6T8B127+Bm:Z3GV53E/BlmCHSk7SR8GQR7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850941, "uuid": "46bdc5b2-bda4-4740-b5b2-c38f83b13c4a", "value": 514284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850941, "uuid": "382becff-685d-44f3-a11c-f66aa6212887", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850941, "uuid": "7b953bbc-5ed0-4344-bbf3-53710e64cb48", "value": "Invitation PQ Documents Submission.PDF!.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7da90da-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621838311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838311, "uuid": "2c88dab2-ed43-4b74-a861-52487b8b7d9b", "comment": "Malware payload (Gozi)", "value": "526b7faa3b330ec7390cfd501504e7ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838311, "uuid": "31b3efde-02be-45d1-91be-4cbca6f3ffda", "comment": "Malware payload (Gozi)", "value": "0ec847dec15446cec4d80a76bd4eb7ea49033ae5dfc05a19500dae395e0e93fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838311, "uuid": "e9bed2c3-1552-46b4-9bbb-94c34c048611", "comment": "Malware payload (Gozi)", "value": "864503c8df4e15c76cab6441ebe3ecee721ab0be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838311, "uuid": "c4406e02-3454-4841-9441-508bd99cac8d", "comment": "Malware payload (Gozi)", "value": "069f0d0de28b9ccc09ca44412996366ee82ef423ad12ca9b8a16afbb7d63892a4fa8ef7ecf723dac0518fa33a9649c9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838311, "uuid": "5e8cd915-54ca-4771-b6c5-f4e7c0aafb33", "value": "D415C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838311, "uuid": "307a7898-9ed5-4575-8280-987bdbf71f2d", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838311, "uuid": "846435b9-2cc5-4704-9067-c09362666f8f", "value": "24576:HQfpzjXPgfx8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDg1JV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838311, "uuid": "479223e6-0654-4d2b-86c2-75f94d145815", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838311, "uuid": "29f416fa-34a1-4c1d-bf34-fd54d206fdc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838311, "uuid": "072d4c74-001a-4223-81d9-99e74e65e309", "value": "526b7faa3b330ec7390cfd501504e7ec.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f53e192-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814460, "uuid": "8750377f-020b-4f77-b72b-1c7a4ef6dcf4", "comment": "Malware payload (Dridex)", "value": "1bc0fa393a0ac273011abd7e9b42f6fe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814460, "uuid": "ba7cde65-d75f-4f3e-9d7c-5863c1a8c682", "comment": "Malware payload (Dridex)", "value": "0ef4649c6de7f90d2fac0f35a49459a244699822b77eb029e4693c149af10457", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814460, "uuid": "4dd1350e-0ae7-4ebc-83ca-96fa1d788e5e", "comment": "Malware payload (Dridex)", "value": "23e95575019da56ded73b4f01096790c30948ec7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814460, "uuid": "eb7a691d-6c4a-4187-86a3-332e856fb738", "comment": "Malware payload (Dridex)", "value": "c8c84574f67560eebf6d170f45ffdbb3d9d5404cdddb36c3056bd74296d0d37651014b59e6a83ca5c83b5f485184f958", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814460, "uuid": "563dce75-b50b-4310-92b4-8efa58be4a4a", "value": "A1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814460, "uuid": "0ab03a03-63f0-4909-9b33-6375c83b56b7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814460, "uuid": "e5a92a38-2762-4aca-b76d-151690117115", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814460, "uuid": "57d1b69c-8952-4c17-8991-f1dfd2f29a66", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814460, "uuid": "aef3fedf-d3f9-4b1b-ba79-403da170e80b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814460, "uuid": "f2b69749-9988-4139-bef6-639ca2758a95", "value": "1bc0fa39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae811047-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621867528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867528, "uuid": "dd780ca0-32fc-4072-b4d3-d136c9861248", "comment": "Malware payload", "value": "dc76dc7df54b1f4a5fcc3abea0d5f1fa", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867528, "uuid": "1c66ed52-bf7d-4a1e-a510-5c3270b992f0", "comment": "Malware payload", "value": "0f0a22cdf88b8767785f6113b920b9df1375559eb4c95a015221ad3d0a4a118c", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867528, "uuid": "bb71f666-2c16-465f-8101-7a52331a5fee", "comment": "Malware payload", "value": "b88e92f0a9e739d244cdf1eca8c6a0905a7f6874", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867528, "uuid": "d82c8799-e485-42c3-9482-c43cb85ee4a5", "comment": "Malware payload", "value": "8603579cd380c7ddbf7f4fc1df892c2f2dd220bc4a061efd04ed894f8bb48eac5a508386235ad1255d69a834d5df36b8", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867528, "uuid": "fa4d7353-33d0-4d23-baab-2fb297c00c2c", "value": "41A423170C3A6EE5609FC087537E77319E8CAAD08F78A54FABE164F450109A340BE5FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867528, "uuid": "8b2372bc-8304-409c-b56a-0a63c9b1fac9", "value": "12288:qiQ8MWwJPOMtyw2xAyUhYYU2yu9+4WxARP4jQA7:qiQ8MWwJPb/2xkYq+txsQMA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867528, "uuid": "d02a0ab3-49e5-4a89-9087-4c34bc3761db", "value": 486547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867528, "uuid": "ad790917-c37f-4d18-a4f9-5175ab5b9f9a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867528, "uuid": "3371c0b5-b76c-480f-83d7-be7c5d0ae8b9", "value": "09090000000000090.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b740107-bca6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870878, "uuid": "d14e596c-2860-423e-ab78-640e52b4e018", "comment": "Malware payload", "value": "0c836446d974aadb1d363cb44f50a4ea", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870878, "uuid": "e5c7a9e0-5b78-4b53-8237-240920f76261", "comment": "Malware payload", "value": "0f42389501701594e8893e1657cc64363f4396eb5396cc36096bd29a5fc237a8", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870878, "uuid": "e38593ab-befc-47e1-a113-66b4cebdc5a5", "comment": "Malware payload", "value": "e8580ecb674487eb3b6257aa6c5769067c84e94f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870878, "uuid": "389a145c-44ab-4e06-bf8d-1a8f43596c19", "comment": "Malware payload", "value": "216c7422bdc8b0ce7d8a5bc35a7f963b4d12341fc7fcdca702737c2880f06b78a93967e7cf78fcf47f31f9d34ba7c5bb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870878, "uuid": "ae7c2317-b577-419c-9b15-8745d11749a2", "value": "B6B423CCAB91983AF79800B7C445A7920CB75AD34D432E1DFB2265D0B7B4D7641E0FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870878, "uuid": "3e1e4d03-8b95-4f9c-b630-85fbd3d22b42", "value": "12288:fiiEthsYMlPYnW+MarqTwnA1/FAO0KUzbKlLcpRK:fTwhhTz7edAOMzEobK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870878, "uuid": "23623836-f2bd-4b24-81cd-99816d51e173", "value": 498242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870878, "uuid": "7c272daa-26c5-4684-ac25-f74656a28b2c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870878, "uuid": "b88753b8-21a8-422a-97c0-4dc831e51e42", "value": "1728374868_655359419.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554dcea9-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621854064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854064, "uuid": "bcdbc2f6-5d87-4d87-8cfc-ab0d75d33b2c", "comment": "Malware payload (Formbook)", "value": "388e23a65590528ff3fc6f191e15bfab", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854064, "uuid": "30e40ff7-925e-4af9-855d-ded59d58c10e", "comment": "Malware payload (Formbook)", "value": "0f4310fc69967760f19d3fffce58040078ff90ee18ae464d8bae9803a97c9d0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854064, "uuid": "0429ceea-aebf-42fd-ab75-43505bdd1a53", "comment": "Malware payload (Formbook)", "value": "d06c2fe8fc199090c415c5cb5514ef6d36288387", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854064, "uuid": "026f11ff-483b-4724-ac5b-7ceac13e9f6b", "comment": "Malware payload (Formbook)", "value": "27afe6fcabdf27822b7a6bd1483ad0d65e9535e9eb8af41024770a1c25436e92265875697e66a11052ee9fba4ad76bcc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854064, "uuid": "dfafe7d2-e660-4052-92e5-03166b9ad1fd", "value": "69441215B9D4CCBBD996137119279F5FC7B7AF800AA1260317A03F2A79361CBD91E282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854064, "uuid": "994559fd-a459-45c0-9588-c9d0a516bf01", "value": "6144:6E/sBcjHkQjVCmeH/5bikVYhav50hpY39:6EKcjEWVCr/5XVz50he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854064, "uuid": "00182d00-13dd-497c-a617-c969c7810ba2", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854064, "uuid": "f8179a25-fb1c-4079-a37f-69cab6ed899e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854064, "uuid": "543c1c4a-5df0-47bb-98ec-dffbaa352232", "value": "388e23a6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcd66b4-bc8e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621860735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860735, "uuid": "ba290229-d333-4568-a20e-5a0487cbe5d5", "comment": "Malware payload (AgentTesla)", "value": "a2cde9df79c7da2eb1581c36be303f43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860735, "uuid": "86ecbd32-2282-4712-99b8-c10a8d8688b1", "comment": "Malware payload (AgentTesla)", "value": "0f45365f3732e64cc81b0daef9275e9f8f83f46df785399e207a9a7ffce7116b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860735, "uuid": "66e83d2a-ae6a-464e-bf0e-2cb352160612", "comment": "Malware payload (AgentTesla)", "value": "0029c26f1605b27a4f754feb42229e13b62fd76d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860735, "uuid": "fe4bdd20-2e9a-4168-95c4-4f22e07b0b95", "comment": "Malware payload (AgentTesla)", "value": "4df640aed6581cf41aaa661a6b4f01e7db8e22447d84b9781f2c88904a55d3fdb1863f84341146d5fbbbf91f6ab5fa98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860735, "uuid": "15ea8965-f602-490d-b013-d41efc981bcc", "value": "DBB4D05C72A0B59FC82BCE33C9641C609A30797BA72BD30B915715AC5A4E6DACE107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860735, "uuid": "3f95f5e1-c20e-4c81-9313-5310c16a60cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860735, "uuid": "76c30041-6f1e-4940-b9bb-571b1b4ab32f", "value": "12288:5Z+/3pROBw7mJwho2PTm1tR7+vUYnvGddwns0RNqhJCjyndTFuabPnd6I2asupc2:58hROBw7Fo2PsR7+vUYneHwns0RNA2yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860735, "uuid": "1455a682-194c-45e5-998b-df1c19acd2ec", "value": 523264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860735, "uuid": "88fb77a3-9d2c-4ab8-985e-c94f7e3d817a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860735, "uuid": "d03b5f44-ae8c-4df4-a999-afec51c536fd", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57e1dd-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621871150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871150, "uuid": "0f889cca-b463-4fe5-b3b8-f9ffeb0f89c8", "comment": "Malware payload (Formbook)", "value": "513c69b3f5b267afe6c3c032092ba8f7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871150, "uuid": "ec8aa8eb-6515-45c4-9c77-f1b8633db28a", "comment": "Malware payload (Formbook)", "value": "0f600e10b529dc3af8dabf5aa567598fe6a0c5a373d4f20e9fba390735257bbe", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871150, "uuid": "ba8bfa10-4fd5-4490-a82f-eb5afc6f16ac", "comment": "Malware payload (Formbook)", "value": "e44b2b16720bfaa72aa56b0465e0ec1d8d1d495c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871150, "uuid": "f99b23d3-0cc2-4c7a-b95c-68bb3aa8cf9b", "comment": "Malware payload (Formbook)", "value": "bc9947d7387fbc48b3e02fb402479dfaec854d5f0f710d76be5e25c9e9f063e765b5ccf92f1e2b8767e139dabba354ac", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871150, "uuid": "735cd4ca-ab1b-429c-ba79-a2a78df4cebe", "value": "0115AD2C516EF126C2ADC37946D4843BE590D7377132BE29ECD7179C1B29E80B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871150, "uuid": "e5d919ff-a0cc-4512-87d4-c3220d9d21c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871150, "uuid": "bbba2504-1cbd-4c2d-a51b-0b64d82b00b5", "value": "24576:sBC6fC99fSH7AKUVDWcv2fEtdzu1pJ2bQ:sBC642c2kwJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871150, "uuid": "3d9bd251-57d9-4da8-ac07-0cae8969cfb3", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871150, "uuid": "15cd11fb-a30e-4d56-9155-f7f120e3a7ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871150, "uuid": "b3ca77ea-65d6-4505-a93a-2f49ec8d1807", "value": "DHL_AWB NO#907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a174cc4-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621871225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871225, "uuid": "cc5da386-bb82-49e4-be5e-fd29823d4d9e", "comment": "Malware payload", "value": "2cea45b9ec8511dcc29854f3eefc61aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871225, "uuid": "226d5fed-77f2-4359-a1ec-5a2b3f05a23f", "comment": "Malware payload", "value": "0f8ce6f5eb21291a23305d675444658dbe619d7a9131c4bda4b49d20d60afeec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871225, "uuid": "8056f043-45d4-4e21-8e79-27e59924855e", "comment": "Malware payload", "value": "146635d2bbc7dd354bff25ead62854f92c5a8f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871225, "uuid": "3c559043-cacf-47a1-89f0-f70f0fcb2f86", "comment": "Malware payload", "value": "16d49161e3f1a79d4984d722c107adc38277df9a340955098a8eb5acb58a80e3062617ac114d7f49a8b0acff565a1bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871225, "uuid": "66fda785-8172-40e0-95ce-6213f24eb93c", "value": "40455A0BFB49BEA5C11D4F354157194C83DCC4673372FBAE92E5A0E3BC0279A4A4A1A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871225, "uuid": "5d9563d5-0b40-4fed-a512-cce5e3cb55e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871225, "uuid": "ca3c546d-87a4-48af-ab6e-2ff687f2f316", "value": "24576:MGExvnr8xqCtHCZvYsng2cEplKQGKxxq8:p0r8HiZwsng2LGKxxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871225, "uuid": "b833596f-fb08-429e-bc5a-3b9aca4188e2", "value": 1165824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871225, "uuid": "eddc9c9a-6d25-4967-9af0-f29a8e5b8019", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871225, "uuid": "b49d6808-5ea0-429e-8aae-149d2888b45f", "value": "DSV_MX11802787372PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ddad3d-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843411, "uuid": "1bd8ccb0-d5bb-45ac-b903-464fe86eca17", "comment": "Malware payload (Dridex)", "value": "bc34a14acfa153214cec8989569ab9c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843411, "uuid": "ed841c44-c0a6-46d1-bb26-f641d86796a3", "comment": "Malware payload (Dridex)", "value": "0fa7804db609bee4926e965798aa0d8dd63be825ecdd81dd7617a8afc13d0cf2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843411, "uuid": "51b868c2-7c09-4006-bdfc-42fc698e3991", "comment": "Malware payload (Dridex)", "value": "652d2f205977ac2c03e5a816508aee2a347b7287", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843411, "uuid": "e178389f-d418-4084-b031-730c1f1c810e", "comment": "Malware payload (Dridex)", "value": "dd8ad565a97d543f2004d5e399d9f7c3923d2b4c043b2eafd932c24c0788b0afd430b20c2ec1d700791e5ad9656a8256", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843411, "uuid": "82774a79-6b1a-4d41-bf6f-3bf18f982ed1", "value": "84F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843411, "uuid": "d2505526-dd22-4a79-94be-680ab224484f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843411, "uuid": "6f608a94-44ba-4bc6-8ef0-b70d0300eda6", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843411, "uuid": "f2479cd9-a6bd-425b-b6bd-4050e1a0991d", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843411, "uuid": "3687f5a8-136a-4b9b-a7e8-782a5bfac3a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843411, "uuid": "f1c0e063-a4c7-4aee-bd9d-401e6444a477", "value": "bc34a14a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3db1ec4-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621861551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861551, "uuid": "df42f9b3-53fe-4ba5-a3c0-e1ed3eebce97", "comment": "Malware payload (RedLineStealer)", "value": "f1e3493ea6680716869dad8862af9819", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861551, "uuid": "bfd9e524-9180-435b-a537-bb7cff62e606", "comment": "Malware payload (RedLineStealer)", "value": "102af82a3e7b2d394bac5a80c4f97cdafe9be52bca002e1d824c810c8a760794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861551, "uuid": "b2d335c4-4032-4e3b-9d6f-3a0838a919e0", "comment": "Malware payload (RedLineStealer)", "value": "7c4ffb36fbcef75d78f5bad29db3f0695b95448e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861551, "uuid": "1e577f10-dfc7-46b3-8372-0a98f2b19b14", "comment": "Malware payload (RedLineStealer)", "value": "070d7b1b39cef921646eb2c49addd2b44e1411e4312e2f90ed4aa8dbaceae004e82a87fd5010aaa1939c92d4a3910142", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861551, "uuid": "0b7461b4-cb6d-4a96-9eb5-1561dd63d526", "value": "2504F72325E25863C1084739E4A2DF373769CD240641F34AB4C5BEA7BD6E7CE48B42B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861551, "uuid": "f059795d-d3d8-45c3-9995-c71177787d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861551, "uuid": "fcaa2657-fc50-4c76-acdf-05cd745b501d", "value": "1536:Myjps1n2C12JXMzvQbKom3cXctdgk3cBJTOC2wAtkxlWfYcRPhVKGyOTCep:MepWn2C1QMzWv0cMTCJzlncRpRnT5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861551, "uuid": "46c5090f-4b72-4560-9714-11dcf8d06eab", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861551, "uuid": "ad70a994-f06e-4fc6-865c-20758d86b36f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861551, "uuid": "9d1738ff-954c-439e-9057-139040543450", "value": "F1E3493EA6680716869DAD8862AF9819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd34a69d-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868465, "uuid": "8cd63045-eaef-4fd4-b7f1-48f6303c7924", "comment": "Malware payload (Dridex)", "value": "d79ea4644f986799e6ca89561681a5ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868465, "uuid": "6be243c1-dbd1-4236-85df-7e2b6845a838", "comment": "Malware payload (Dridex)", "value": "1050bfc7054dc04f8529b56cf81e998c9d878fa8adef0f044cad6873d79e7bfd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868465, "uuid": "a16bdc58-6a23-408e-9c5c-006d5f65aa17", "comment": "Malware payload (Dridex)", "value": "dbb56ae97214d7064cefac7d0eb1952e17c835d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868465, "uuid": "b9990334-0942-4c62-a342-4f220a19ae13", "comment": "Malware payload (Dridex)", "value": "75d500a457b42dba8fd99e6098286a270b0897a318b1d236164708d2db55c83aab821829e02c3ce137507d7ce37ab2df", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868465, "uuid": "07ad9fc5-2a97-4bbd-b701-e53487eeaa24", "value": "2DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868465, "uuid": "72fa10ec-d87e-4342-8b40-96243d01301f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868465, "uuid": "302edec5-7fbd-45df-aab2-0cf299b3e452", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868465, "uuid": "69df98b2-4b31-4306-8d74-072cd61cd8c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868465, "uuid": "5a192d62-4a97-4bcc-8dd4-e7896d97716b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868465, "uuid": "5fff96f5-2539-4746-8bc7-745d4e12ab90", "value": "d79ea464_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9732ad6c-bcb7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621878226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878226, "uuid": "c6e8d235-5dff-49c6-af99-862615132525", "comment": "Malware payload (AgentTesla)", "value": "64e480f175cf087d8f084f20f93d5843", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878226, "uuid": "3dcad2c5-e41d-4062-8525-6f89f0b94847", "comment": "Malware payload (AgentTesla)", "value": "1170c143e22541ebce0945bd4aae52dad1cb260620a850552731d708fb405ebd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878226, "uuid": "56b37af4-8dff-4689-9028-ae5718aefd00", "comment": "Malware payload (AgentTesla)", "value": "2b9f515023c6a56f258faf41ab1c233e89d81227", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878226, "uuid": "bbfa90f3-2e8a-435f-b405-2eea975c71fd", "comment": "Malware payload (AgentTesla)", "value": "4339df9d66245ad792e7f4115e09095a51e309c50651c54e5970b85cdffe994a7de042454950e52cb71eafd704f37d11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878226, "uuid": "e7bed101-82c3-4712-92d0-d2c41a0c2cdc", "value": "6A156A2C506EF126C1A8C27946D4C43BE590DB377032BE29EDD71F9A7718E81798227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878226, "uuid": "6ed27d8d-54ce-4152-8718-60a4ae69162d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878226, "uuid": "ceb34f04-793b-42f6-9683-a3f795fc2069", "value": "24576:BVo/Tq5BCZVBUFsU48lQA56GpFS1UfC4X/6+vLYmrb7:75BCZMSU9Qi6GAZkv84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878226, "uuid": "9309a7eb-d9fb-4dae-a0cd-b5a5e9d3f6a6", "value": 910336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878226, "uuid": "9e7c6f0b-94c5-4c11-8969-eb395f91e4cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878226, "uuid": "61e29963-49e2-4e49-8b71-696b360b1ce5", "value": "Glastra WR-101209-00898-BUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628f3b72-bc86-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621857093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857093, "uuid": "69a21560-2ab7-4e75-9479-af04f21ab222", "comment": "Malware payload (AgentTesla)", "value": "7f0f0a874b085b4f16dfcd2e2a7389af", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857093, "uuid": "295f36d6-577c-4478-a91e-9b84f7002d73", "comment": "Malware payload (AgentTesla)", "value": "119530df722e9f97ed26fc3238dce5b90b2e2dba1669e827cdeff298554b3c11", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857093, "uuid": "344fc4ea-e9e8-4cbb-aedb-0c124b4e04f8", "comment": "Malware payload (AgentTesla)", "value": "4eb0702c1e39006ed97e56c5c315123e81e261a4", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857093, "uuid": "c5e05bef-4070-48bd-918f-18a61c1535a1", "comment": "Malware payload (AgentTesla)", "value": "dda920a3e7e17faf9d36e87c6bdc5972898372a250a7877fabe212e3c56f126b323f0c1aa6442545124121ac6f5ec831", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857093, "uuid": "54505102-2c58-439b-9936-94462b586608", "value": "57A423DFF63DDC10AA5ACA3D1848527B3498E13DA21A1C976DC448F675843F6A21AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857093, "uuid": "18b38572-fac5-4d08-9158-05ac32b1434e", "value": "12288:mLNh9C4hd8Q4cXD02sRoochJRB/U4qfECDGzcU4r1iftR:u8hcnWt0JRB/Dqf9zU4kf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857093, "uuid": "0c53775b-c769-4c73-bdfd-25005d6d3c46", "value": 491136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857093, "uuid": "91f9c4d5-ccb3-44a9-bbd1-1b49a620c1e5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857093, "uuid": "6d4245b7-016c-41bc-96b7-003eb72c6c44", "value": "PDF#Purchase order22435.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80d8ea0-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621872295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "59cc6f5c-c00c-4956-9ff2-737649fcc3a2", "comment": "Malware payload (TrickBot)", "value": "a3a8ffa3ee928005d9440a2b042f5aed", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "9d00650f-6f31-421b-9719-3e293c0a182b", "comment": "Malware payload (TrickBot)", "value": "11a44ba15c5c70173d4a79b34420d466f659f1e768e9673bd99e67f0a85e5ea4", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "209fc4cc-ba72-45ae-b294-06f58a6b4b02", "comment": "Malware payload (TrickBot)", "value": "3c20e1bc6c9db2c6766409bc925dc2102369dde7", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "898c1ee8-531d-461a-887a-9a915fe55ef4", "comment": "Malware payload (TrickBot)", "value": "9de0584f742fc9930f8fed8999973fbef721ef176b81f09b57f3e395c194d9b9fb4844ce9dacd3e176ef1f7943f25f87", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "c780615a-08d7-4ed6-94c7-583dbc945dbd", "value": "070402EDAA91E525E7A408F3C4405B831C771FC747876C6A7B12628477B09F742C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "aaf168ef-5f0c-4103-a811-7154eb744b94", "value": "3072:SRevjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHzX:6ov8cKSsYodBXC0YnW49MarG19TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872295, "uuid": "057cd39d-f704-4365-b44a-a5869180d2f0", "value": 187789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872295, "uuid": "aa0bf860-224b-49a5-9ead-33ccec70a96e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "075b8473-9ea0-48e1-9925-66f8902a3899", "value": "a3a8ffa3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fa2a1d-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879380, "uuid": "95ff03ed-48cc-426a-b40c-495493cb25f4", "comment": "Malware payload (Dridex)", "value": "23c50d3ae980f8564c3220fe9427d9b5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879380, "uuid": "8377f7f1-2a63-4fb4-ad96-01736db0f0bd", "comment": "Malware payload (Dridex)", "value": "120fd2cc494ffd22183f3c8c07bccaff74351ed6f4a64b11ab1a2bd0a22aa043", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879380, "uuid": "fbca3ee2-301e-4dd6-b491-a5e00c44086a", "comment": "Malware payload (Dridex)", "value": "13cf92f321069c776ec5270182433c58a665515e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879380, "uuid": "c6c84a77-74f9-483a-ba82-b81f075f5ca8", "comment": "Malware payload (Dridex)", "value": "e25007358672e5e5f3d8850a4dc5ae4b6cb14ea8874ca91b9d2567e395422a98ad9cb021572bcec4b584fd9788a3bb1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879380, "uuid": "cf0e2776-813e-4a6a-bf5e-fe9da575856d", "value": "71F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879380, "uuid": "8c98c8b6-9bb0-4a5f-b457-06110a2a050c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879380, "uuid": "a024b9fa-f96a-4cc1-b8e1-50db2bea95ca", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879380, "uuid": "82fd437d-fbef-4feb-93b5-a85fa2b716ef", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879380, "uuid": "9144d6f5-10f2-425d-bfe3-0425f7dfbcad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879380, "uuid": "af84b30f-c47b-4897-8184-62226e653fdc", "value": "23c50d3a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40631c2f-bcc8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621885382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885382, "uuid": "87cad3f1-aa26-4c09-b207-85c37a2db8dc", "comment": "Malware payload (AgentTesla)", "value": "3019535ea4671e89290be9f21689e5b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885382, "uuid": "960fb070-09b7-4a5c-8cfd-1f4aacd85dc0", "comment": "Malware payload (AgentTesla)", "value": "127b9cde68b6a832e339a21aa56ac953ac36d1f6d2196bf8b0dc0600047ad619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885382, "uuid": "03decc50-b8c3-452a-bbcd-e4cbb7f8c6a5", "comment": "Malware payload (AgentTesla)", "value": "430b8438cd13b992c4744391ff1c9a9874cfaa74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885382, "uuid": "c7646d3a-890c-4685-8c54-4cdaa1a1633f", "comment": "Malware payload (AgentTesla)", "value": "2d2ff2b5a89619817afe383ba2ba922b233bdecb9fa02df0d01c415815526f14c2c23ec7e6c45fd2b4f51027b07686fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885382, "uuid": "a3107cf7-bab5-42b6-94a2-ab5e34690731", "value": "6445F21CA169A132F468C67906D37027ED18C7736021A9949AF7075F2F37EC0BB8A5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885382, "uuid": "c846704c-118d-41eb-b1c7-5542269c9b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885382, "uuid": "2e2eaa1d-6673-4517-a2d7-614161a0ed05", "value": "24576:BDV8bSV1MKrdsNRu2GXiAuXpJn9XciMxKZdV133:5rdl22uX/n9XuUj133", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621885382, "uuid": "560e869b-d53b-4f55-834f-9060032f4ed3", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621885382, "uuid": "f91326e5-2892-4af5-b272-bffeffea697d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885382, "uuid": "2d66112c-6547-4d2d-b7ec-8185db0ce1d0", "value": "UN Facility Mgt Tender.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83676b28-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843404, "uuid": "e176423f-07d6-4014-a26f-4d3d1eb41bc7", "comment": "Malware payload (Dridex)", "value": "7bcd7d625dc96fd4e1e5360e102852a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843404, "uuid": "4023c7d9-1c72-45f8-bb9f-f18eee4ca44e", "comment": "Malware payload (Dridex)", "value": "12852b22da04bb3e0abcc2db33d1876d36423aa9fa4ec396f0933826a4afe625", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843404, "uuid": "39356339-1a4c-4fb4-b71c-0a9d249bc44b", "comment": "Malware payload (Dridex)", "value": "aa4740b12234b9851e3381f0349fdd76ed19b3de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843404, "uuid": "baf3733e-4f7e-480f-888b-4ee790046b77", "comment": "Malware payload (Dridex)", "value": "9fba8094159bb53217555bd51fb938ae7e44cf7977d72cdc4485fbea603cbdecce61e01217e87ef654ee044bb50d44e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843404, "uuid": "9e860a98-3ec1-4fc1-814b-03d43ec0b360", "value": "EDF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843404, "uuid": "410b125d-cb47-41fe-a174-30f1ab6e3ac6", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843404, "uuid": "7257dd84-c515-4185-84ad-2ffeba2c4742", "value": "3072:1iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:eeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843404, "uuid": "950f6b40-331d-401a-af95-19718bd5e6ba", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843404, "uuid": "12778007-2988-4e42-8a1f-5423c755173c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843404, "uuid": "51b5c3a4-0a0f-4499-9770-f29988775960", "value": "7bcd7d62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa6c505-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868622, "uuid": "76d5d7c1-d335-4e51-b926-7f7c403a7053", "comment": "Malware payload (Dridex)", "value": "2ec382398d0377ede12df525dcef5dda", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868622, "uuid": "6551176e-4373-4569-919c-acf29d44ff42", "comment": "Malware payload (Dridex)", "value": "12a835273afa91c41f8a06b35e76f90d8e5b3f840cd0f5798a5bd5e6b9613d7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868622, "uuid": "17dcdc9c-b063-4504-8b2e-dde11e8f6e9d", "comment": "Malware payload (Dridex)", "value": "116a7e594e02aae9630901de0c088e52c2c80cb7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868622, "uuid": "3b637f19-a8e7-4a09-8012-c71775fcb396", "comment": "Malware payload (Dridex)", "value": "02ff6721b4262e9364b9255a09b5d1c41b7d2a9298b9f5d26afe0b3bf8ce78e15fe16f4768e61c75f3df548594087c1b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868622, "uuid": "89027030-2c95-4b81-a656-370deb217412", "value": "83F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868622, "uuid": "6954ce07-6f27-4796-a8b7-8a00671cd3d0", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868622, "uuid": "43a31408-a6c5-43d7-a632-ff453415181d", "value": "3072:NiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:WeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868622, "uuid": "a771a675-3777-46d9-9827-bd17ec899bfd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868622, "uuid": "7934e8b2-a0c7-45d5-97f4-8095d0766d7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868622, "uuid": "3c7e0516-3c5e-4d8f-8a2d-8f0c85d769cf", "value": "2ec38239_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627a9b46-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871266, "uuid": "329ea4c9-070b-4b9e-a1ee-bd23210d32c1", "comment": "Malware payload (AgentTesla)", "value": "4dd236947be5e331271f6b6cb4ffea9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871266, "uuid": "33520a0a-9111-49f8-a48e-7ef4b14522e8", "comment": "Malware payload (AgentTesla)", "value": "12aca308f4e8bf9d42f8f01ac64b171c5851ffc356222feaafab2a84f307de75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871266, "uuid": "4c14c771-b0c4-4ec9-b579-713f71d8fc5e", "comment": "Malware payload (AgentTesla)", "value": "3bb6e42c30552f455f3381696dffc4752d320af8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871266, "uuid": "f653490b-b7e5-4f65-ac8d-06b6891df29e", "comment": "Malware payload (AgentTesla)", "value": "df5364393f7291530da15e7001aea1ec51bfbd41c61c25e2ba34ab11974ae1f8b85887e37d30cebfb1828dc5334ecefd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871266, "uuid": "ab09def6-0b85-4e79-807c-0babf4ae623c", "value": "2315AE2C612EF126C1A8C2794AC5943BE851DF373030BD65ECD77B896B38E41799227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871266, "uuid": "cb569dd5-a678-4683-baf8-b597fdfe2f9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871266, "uuid": "8210d986-d3c0-4093-a06e-ae8ce3cb5847", "value": "12288:dJqyhULU3eI3aNmn3WyaZSEn5jRGghkm/c8Ej+tO417pHltcoa55kx38yXnnSyy:dGLlOacnbacBWiiB9BZ65kx38O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871266, "uuid": "192173f9-809f-4011-811a-37bfd1d94baf", "value": 908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871266, "uuid": "b6e9d6e4-dd3b-47ef-be8b-33c1b9971e95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871266, "uuid": "7e019efc-f3af-415f-8584-d9678744876b", "value": "1xNTl3dpzzT4glJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb21c1d-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897241, "uuid": "e3ad8c8d-1534-46d7-bdee-fc5769585a40", "comment": "Malware payload", "value": "e6b93d562abf6cd2da5a0ccd637ac3e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897241, "uuid": "e9b1f79a-78ba-4d9c-a9bb-9711b61271b6", "comment": "Malware payload", "value": "1320e418c82ba1c1fe7f0f342aebad7d19b48426c32467ba6d364ff7dcf6bcaf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897241, "uuid": "dc4c1668-7f82-48ee-906c-451aef0d3185", "comment": "Malware payload", "value": "66cde1326799f670414b00b9de96de7a11a25ef4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897241, "uuid": "8d753467-cea3-49ea-8c6f-f7bbfd64ae67", "comment": "Malware payload", "value": "7034c6c1b465ff8be4a31c84a66bfb98578b8151ff7eef5ec1347aa6225bc1fe5a8aba0125bb202251beb4a73a1dc5bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897241, "uuid": "80b798e3-fde3-47ea-9724-4c9d331a0b50", "value": "B8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897241, "uuid": "ce485cd4-60cf-4511-8211-dcd92f03d707", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897241, "uuid": "668f0aa5-8cec-4e77-9c58-721393edb48a", "value": "3072:gTiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:gweAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897241, "uuid": "40c85817-a3bf-4248-afd6-bf214c44c2ea", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897241, "uuid": "af91126b-79cd-4610-8b9c-3272e2d7b1c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897241, "uuid": "ac895035-948b-431c-88f7-828b61493312", "value": "e6b93d56_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92f6074-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872324, "uuid": "566bd85d-99a0-44cc-83ea-597a62749d6c", "comment": "Malware payload (Dridex)", "value": "8eb7461dad2d2a6fce432f6c37332918", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872324, "uuid": "7e837ebf-b3c3-47ec-9882-31da063f2da2", "comment": "Malware payload (Dridex)", "value": "135a21099f8a324c01daac89fa24fbdc24d8afeb04566c07c4b4461c896c2197", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872324, "uuid": "aeb05ae8-ded7-4a1d-a8dc-93f92ee928da", "comment": "Malware payload (Dridex)", "value": "b5cd73d4bc4e8e132ac15e7fadd8d698366de35f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872324, "uuid": "702c31e0-6f20-4733-a686-0455614594a5", "comment": "Malware payload (Dridex)", "value": "78fdce655b5c1191ded9561eee780dce2aab90c3331055eb6c3618eedbcb22bab7f63d4e5d197f5314658e1217dab7b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872324, "uuid": "d380d554-5f97-4140-813b-11069d4448ae", "value": "5CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872324, "uuid": "74f39307-b144-4ebe-83aa-26d90d06043f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872324, "uuid": "b34df3ff-1680-4388-90f1-83d6930a6779", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872324, "uuid": "c86f77ff-1135-4589-8dff-a5a2f4c9de23", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872324, "uuid": "3ede79cb-56c3-402c-bd31-96a3db6a9d15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872324, "uuid": "91e507f5-63a9-4f1f-84a9-fe094f89d4e2", "value": "8eb7461d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08251f20-bc91-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621861665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861665, "uuid": "82796812-7846-45a6-a55b-62054271af78", "comment": "Malware payload (AgentTesla)", "value": "ccfec5a1497fb5091e2c25cf8e13e180", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861665, "uuid": "98f178b0-6331-4a2b-bd98-f279cdc1c5d6", "comment": "Malware payload (AgentTesla)", "value": "13af5e008abf4380ac84c6edc70d188bdb18ddb613c7ffaaec39085cf0a43e45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861665, "uuid": "99a248df-339e-425a-840b-0dc33d884e51", "comment": "Malware payload (AgentTesla)", "value": "728825e2370905c991483365c08b1d4917ca3bf4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861665, "uuid": "7fd90f31-7167-4d81-8a18-daa184ba0537", "comment": "Malware payload (AgentTesla)", "value": "55766271fbe63c56835f120dec9348da40192a079745c9453647bbda572fff3d3fa036b20f581bb192be19f631a9dce7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861665, "uuid": "1f4ca940-6a3d-40ff-8a8a-778f577ec704", "value": "3025061E2E99E119E1D8C63D46FC402BFF42CBB3203AAED698C7776C0694D41B85166F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861665, "uuid": "ae39d601-3732-470e-8345-0e5bf8ee3043", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861665, "uuid": "0dd1ab1d-4715-4743-9328-ca058e00594f", "value": "24576:oBCIpa3Ky88SBjOGf1d1WgkotSwZ0qXcws:oBCIsF2bfnttve57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861665, "uuid": "1d2612fc-0191-403a-8e7d-1694bd167d28", "value": 978432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861665, "uuid": "d3da9432-8cb5-45c2-9492-75679c8ca512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861665, "uuid": "8404308b-c8a1-46d0-8942-e25e10eb0b61", "value": "templex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817650e4-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872606, "uuid": "e2e46460-6e6d-452a-b036-1c077b092a9d", "comment": "Malware payload (Formbook)", "value": "48c33c64ee5a8157bc8145efe95bdd30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872606, "uuid": "5c0119eb-1b75-46d6-934f-b7e839d46958", "comment": "Malware payload (Formbook)", "value": "13d0b9cc42969b85ff7742d9976eeb409e4d662c28aeeb5f2092c93accd6b845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872606, "uuid": "4304c276-9afb-4475-b885-f959d655f1a2", "comment": "Malware payload (Formbook)", "value": "4505ea7daf439e0eb83b1d2acc5103099552411f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872606, "uuid": "41a6d3f7-5980-4ae1-997f-a5dcf5fdb1ce", "comment": "Malware payload (Formbook)", "value": "789ed02176dbd03b9793c40e21ae8b73a078a7502ee5befdf3f2a4ce36d2761b0ea4a6b1d1177027e2777db26d272c85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872606, "uuid": "458d6526-3fde-4551-a15e-92e807a0a91c", "value": "D645062DA206E080F55DD071CED0BAF6D406EF3BE5262D1795C73F81313AE827A6A15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872606, "uuid": "dfdf0b3b-c39d-446d-ad77-51def1d030c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872606, "uuid": "0e286a95-28f9-40ae-a546-75d8edd6b6b3", "value": "12288:GXaBC6mVuvVrhDh/4nTPtp2XMT0OwE/eQ5NSayG2+eGGah7zeTuMS9S1:JBC6r98rnT0OwEGQ5t/20PeTdUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872606, "uuid": "6862a2cb-7647-4544-96ed-82bd779c9dcf", "value": 1271296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872606, "uuid": "fa3f6edb-8d58-4263-b345-683768ce53f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872606, "uuid": "91a9ba58-3119-4d11-a842-54778f15c464", "value": "New_Shipment_Order#746945-3056-2045_May-June_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae383f4a-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854213, "uuid": "0d1cba91-aa45-44aa-b0e5-1cbf2db57f52", "comment": "Malware payload (Dridex)", "value": "997aa3f8996f5980e8d6cc47f47f8414", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854213, "uuid": "08806b7f-8617-40cd-91f0-8214d4aed335", "comment": "Malware payload (Dridex)", "value": "13dec867139d99ac18bd8284d33721e63ff153df1c0bdd43dbd006cc5762631c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854213, "uuid": "a3f60100-d928-422e-9c62-a9aa7a5c3a07", "comment": "Malware payload (Dridex)", "value": "98c7d1b0254a0a355f9a131a7d4d2ccc5ad9ff93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854213, "uuid": "1a5134a7-5966-4237-b0bc-ca128cb92655", "comment": "Malware payload (Dridex)", "value": "f5ffb419acbd05f27c86f9b87d555f2da2c2303c00d201409665aff8f8fe282ab0b596a748e24a69f456218038c211a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854213, "uuid": "d3b30884-3816-4e9c-a8ee-7f392c245dec", "value": "E6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854213, "uuid": "744775df-ee2e-4ec4-8d5b-345e0c884820", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854213, "uuid": "80d4dfb0-d55a-4df4-8a1b-1ee2414f2f8c", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854213, "uuid": "9e7d7a82-edb9-40ba-b275-340a501a46dc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854213, "uuid": "32e83662-06e6-480d-94a6-7bac027cf642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854213, "uuid": "9bd17f54-6f7c-4b31-a760-ee1fcdc78af4", "value": "997aa3f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4fafa1-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890157, "uuid": "4d6296a3-d431-4bd7-8cef-5c88b03e0c95", "comment": "Malware payload", "value": "0904c332abc4cbd5c77bc0157696755f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890157, "uuid": "77e3f840-8824-4b12-b4fd-3ce4bea29ba9", "comment": "Malware payload", "value": "14a9e7a3ee7cdb58351c29ecb7e0356e606bebca2c2c61df18cf16464cc80c99", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890157, "uuid": "48ecb9b6-3bcf-440b-b932-48d213c21df2", "comment": "Malware payload", "value": "0aba9907271d89b6007eae5be2d498b5c70cd912", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890157, "uuid": "b5c14425-8d69-4713-b991-24cc7b041fa0", "comment": "Malware payload", "value": "e3b7c1b7653f8f1e9f0f83e7b73ffd7004ec3ad9dbffc7cb5d9f1b126f9dce226d2ab2e2fe433ddab1ad449a8eb2b9a7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890157, "uuid": "c531ace2-08ee-4eda-bf48-185c00caaa5a", "value": "23456A2C106AF521E5ACC63A89D15037E565DF336131FD6AD8E33F993B35EA0788222D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890157, "uuid": "4f5cc5a4-7720-471c-a5de-c439d6e90435", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890157, "uuid": "255e4ec5-c45c-4e2e-af88-06baf73be48f", "value": "24576:hzmBIvmso8jtGTPM/p/qNMr1UIgo51x0ZyS:hiCRoMRqAH1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890157, "uuid": "d0834e53-b56c-49cb-b0d0-f98783ba967e", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890157, "uuid": "ded1c276-9cf3-46bc-967f-e3276642519b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890157, "uuid": "31afc700-f912-4e59-a74c-efd226d7fcd2", "value": "SOA PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aae4d7d-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621861347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861347, "uuid": "c3524c53-d5ea-4cd3-b1be-fcb170a4fbd0", "comment": "Malware payload (Formbook)", "value": "6d403f82486fef48b1883e0f9a28726d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861347, "uuid": "5958d005-8b1e-4952-b7a1-a5cd23eaca05", "comment": "Malware payload (Formbook)", "value": "14bdf4f6b19a915c990311f85f8d82b9b4f3dd9d876ecc9b3ed69e65a4195cc2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861347, "uuid": "f5799cd6-fbce-4d41-91ea-bf204c696f39", "comment": "Malware payload (Formbook)", "value": "ad81f5a3c502221732242dff36813047efb99414", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861347, "uuid": "13522927-cadb-4025-9690-182cdcdd54e5", "comment": "Malware payload (Formbook)", "value": "38280d444ff517544b0505f4e7a43860455070dbe312c05a1bd23501cc5fc3df31b9e445a3546c6a4e2b6ca935689e96", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861347, "uuid": "450afb30-7c7b-4a4e-883f-f8552d4baf56", "value": "F90392E2B285DC4ADA4907364DEBC6E23326FC519F57838B3289F71E1F71AC08912617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861347, "uuid": "1d1126cd-4901-4268-af4d-3e72f23cf90a", "value": "768:/ck3hOdsylKlgryzc4bNhZFGzE+cL2knAJ0OiCgxcmBZsSp5Fj4zM4Pf59:Ek3hOdsylKlgryzc4bNhZFGzE+cL2knC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861347, "uuid": "ac6d80a0-1b6a-45a1-9d62-03df12197c62", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861347, "uuid": "e6ad28bc-3829-4718-b0b8-a20879a1cc99", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861347, "uuid": "eb16486d-e02b-4163-ada2-47fed54ec6f0", "value": "6d403f82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5961b44b-bc52-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621834743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834743, "uuid": "1ed050ef-b771-4e47-a585-c04d96d1f28f", "comment": "Malware payload (SnakeKeylogger)", "value": "b73b9452fe8e2a08ae3ce442c6b2e268", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834743, "uuid": "135788a6-ea97-40f6-b49d-cda9f629c20f", "comment": "Malware payload (SnakeKeylogger)", "value": "14be1b927fba34318fdaa1b2a6c2090e30ecf3da8edc1d94553e15050282fcce", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834743, "uuid": "1dfade22-2489-44e9-9867-1e5a7f610638", "comment": "Malware payload (SnakeKeylogger)", "value": "433e959db01d03952cf1a69c5346866be61afaa1", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834743, "uuid": "a4c16b2d-3033-4582-ab0a-e64e02e3ef4e", "comment": "Malware payload (SnakeKeylogger)", "value": "cd5760e06be9a37e942032e0b25a256df6a4a0349c641f4b935ef3cae59c1eabb7d2eb877d82a3caa45b1c8c92b704b9", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834743, "uuid": "51908f09-017d-47aa-8373-8c44a14f84f4", "value": "BF05E0A113F89F65E03C43798474E8204FF2AC5BA679E705BDDE31AA6FB27814913706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834743, "uuid": "4a48e3f9-5366-43a1-bd1b-4c39e8db2490", "value": "12288:nQaUE7EtgvgCshToXq0tJ8pStM9b2T+AY9l+Lcs8KfVKzg81M:OVa8oztRa9KT+AY9l+Lt8Kfgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834743, "uuid": "34b626eb-f7d4-4450-836f-ebc4020bd6c9", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834743, "uuid": "0305a3e7-346d-4a20-90fa-2e5db0e47a5e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834743, "uuid": "52a7b515-4401-4442-a7fe-cb0f62082d16", "value": "New_order__WJO-0001,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c0ad82c-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814561, "uuid": "e2f241f9-1c0e-49c1-82e9-8db4e3ed2470", "comment": "Malware payload (Dridex)", "value": "d144201365f4a9fb7a5a57516254c1e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814561, "uuid": "0b830c1e-ec5a-4bfb-9831-b80531f7bed5", "comment": "Malware payload (Dridex)", "value": "14cd3f1f2e2e8085fda8d34b7efcc0ebcb581d53532efa683ae4b6766e91b1b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814561, "uuid": "6b0c5607-9cdf-4e3d-ab4e-62bffdce85a6", "comment": "Malware payload (Dridex)", "value": "51fed7c881c8c15ec3e6eccf8b2de64950056fde", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814561, "uuid": "bb2e6a03-b863-4eb0-b348-35a87986b2a3", "comment": "Malware payload (Dridex)", "value": "4c85f2016453a8d86dd0a22b9f794f61a9c6fe88c4a806e2a1221f973af9d04f165edeeacb7549d3bc54eba157126a12", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814561, "uuid": "9a9ab9e1-fc86-4a0d-801f-84e90f7c1117", "value": "ACF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814561, "uuid": "ccf0369e-d75d-466d-bef1-d5da37f36ade", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814561, "uuid": "9f80dff6-d92c-4467-96d7-1b6bd8b9556d", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814561, "uuid": "ce03afc3-4c03-435c-9c89-6434d0b858f1", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814561, "uuid": "19489952-85fb-4e63-afac-90aa7aa0d6a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814561, "uuid": "ae5a4fa9-9cd9-4f9e-862a-5b44f224048e", "value": "d1442013_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3e16cd-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843316, "uuid": "1ac41ea8-c83a-4bd4-8c3b-b4e10db22f3e", "comment": "Malware payload (Dridex)", "value": "a88d527c6a7b6489702bcaac437ba493", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843316, "uuid": "413130ea-cb53-4a97-8108-26e09f8b248e", "comment": "Malware payload (Dridex)", "value": "14ec48ef3bab4f00886114634973ac8eec66a3a6ffe57b0504869a085969965e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843316, "uuid": "cad75706-86f8-4095-a1d2-49d6a6d4090d", "comment": "Malware payload (Dridex)", "value": "60e297cdd73c7e9df14cec41745a6a7ac341af6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843316, "uuid": "f0b53e60-f47d-4b05-8e3e-0719ce7edaac", "comment": "Malware payload (Dridex)", "value": "70572bb50239c227571a8b7d8a46f1a99f32abde7d5265478323facc8ade4ecbe4258780d79f20df1de3caf1c0a02ddc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843316, "uuid": "45a4c70b-5fe5-468f-89ff-7e2bd6b8f0e4", "value": "AAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843316, "uuid": "2807403f-bd4c-4272-8e96-8891a515aafa", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843316, "uuid": "d16bbf25-8424-420f-ba4c-19553f5c9f1f", "value": "3072:Blpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Blo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843316, "uuid": "1b0ea9e4-5776-476a-a3cc-c6a9b887e98f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843316, "uuid": "1094fc7d-14d5-4d28-87f4-0a8e52713b15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843316, "uuid": "79d19992-bf98-4cff-9c7b-fca697abd815", "value": "a88d527c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a39ff3-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825268, "uuid": "a1410423-681a-4e64-b68e-fe1ff8696721", "comment": "Malware payload (Dridex)", "value": "81d50e5e371410ca4d18ed3ab54076d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825268, "uuid": "b2e7cb69-0603-4e9b-ab0d-a28f80f2e126", "comment": "Malware payload (Dridex)", "value": "150011349459444268fd60716ce9dd6094fcd3c4c78ce6d2e9273215d887b636", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825268, "uuid": "dab5f9c9-7e33-47cf-bc50-155c3ca49644", "comment": "Malware payload (Dridex)", "value": "c5f6f169f77c0d464f12f73cbd72127c6f5fb371", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825268, "uuid": "9353ab7b-56c1-4eef-a21b-ebcf52e62860", "comment": "Malware payload (Dridex)", "value": "659a44c6301ae27c055e99535bd9d341bc20bc2b851034661f0c5b921ef07f94bce3a4ba83148671eae63a3c0a5e263f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825268, "uuid": "b8930e07-efe3-43b5-9f07-6783989aee5e", "value": "3404B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825268, "uuid": "4ccf20f3-66c7-429b-be49-4b261317b4a8", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825268, "uuid": "1354736d-0845-4b10-ab35-0d885c36b9e0", "value": "3072:XWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:XWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825268, "uuid": "fbe243b9-6839-400a-8695-43bb63549bb0", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825268, "uuid": "8802b39d-a76b-46eb-b0cc-25449f927241", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825268, "uuid": "9b7935b9-8647-479c-9bef-81d8eb1380e5", "value": "81d50e5e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f5fca6-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890149, "uuid": "2afb86b6-8071-48f2-80c8-56d3938379a7", "comment": "Malware payload", "value": "7591582a7e4f2f49807aeb2f5efb9355", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890149, "uuid": "c77e675f-acd1-4f00-a649-d467c0cc5678", "comment": "Malware payload", "value": "152a401a441807c3a31634ad0002419d226ff5c22ca2146b25deff1f7ab9c789", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890149, "uuid": "fc97e3cb-5c24-4c4a-9efc-1c33e1246a02", "comment": "Malware payload", "value": "3a8dd68754bc8276a7149e181274f37f7aedd0a1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890149, "uuid": "7daf9443-58d2-4747-a13a-e814f2349d5d", "comment": "Malware payload", "value": "d609ba9f55055628d6a6385639991c0342562e1fefafbb76725f13682eec6610a3e5ee0a726cf4bfe20f60d5742bc283", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890149, "uuid": "80b09155-635d-4b44-89fc-f16121f277d7", "value": "20F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890149, "uuid": "f380ac3d-6891-4487-87a9-cd2476fec52c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890149, "uuid": "5758c62f-86ee-47eb-81d9-18f12d5b5dab", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890149, "uuid": "c7e3d5dd-fae2-487e-b585-1951f68f9f9d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890149, "uuid": "e8e71495-714c-4a86-9636-66811c52a62b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890149, "uuid": "a3aabdf7-3b5a-4712-963d-33cb5642ea7e", "value": "7591582a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe142fb-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621838056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838056, "uuid": "9a133916-2d9e-40ab-9ba0-75415eacb654", "comment": "Malware payload (RedLineStealer)", "value": "91a846193a2ec5dec6d0809a56d0a8e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838056, "uuid": "e3c4e130-510d-4679-9658-208474b93695", "comment": "Malware payload (RedLineStealer)", "value": "1614efba901c6f1f312311192190e2d62517b8087e621429c3c0a0b69e94a3ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838056, "uuid": "5e5fabe2-f41c-48bf-80c4-7719e60c5e86", "comment": "Malware payload (RedLineStealer)", "value": "7cbeb999088f38186bba8d095a1220e736a6398d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838056, "uuid": "504b86aa-4ec9-44c8-a204-44506435a174", "comment": "Malware payload (RedLineStealer)", "value": "767ab3e77c7df97ee85e5aad5dc4570021282a293b92811ad9cc1b0c89e13dce496138b73b403a12be5e5b433b219e42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838056, "uuid": "f3b0d996-1d4b-4877-9a24-c3d772635784", "value": "94E4E130A6A0C035F5BF51F445B5C2B9A62A7DE1AB3040FB12DA36EE56349E0AD3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838056, "uuid": "98808e71-b7de-4af6-8f46-e95acabd4f4f", "value": "b37d3fab91f8c78b5fe4ea0b668f6280", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838056, "uuid": "613ef076-08b0-4388-abae-10f4f40387cd", "value": "12288:5hy+6P/nvHcaNUs6Sl111w3t8SQXtxIZvA6nQeED/4XsL/:fyL/cat6Sl11CqNnovGrMXsL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838056, "uuid": "60f0fae8-6227-4ff0-b49a-e0fc00eb8730", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838056, "uuid": "75d7d99a-d22f-44e9-b29a-5fafe10536e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838056, "uuid": "e8244e9e-30c6-4dd2-8843-3a411c1cdaba", "value": "91a846193a2ec5dec6d0809a56d0a8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574e42e2-bc51-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1621834310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834310, "uuid": "6a603920-134e-482b-958e-d2b0c2a5a347", "comment": "Malware payload (STRRAT)", "value": "6f87c68083dc64536a61711e48e98226", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834310, "uuid": "363b088a-2bd9-4b27-9fd2-f4c4535adb6d", "comment": "Malware payload (STRRAT)", "value": "16157bc5cb35a35b1f8f92b0711231e756b783e8270d93e25b6b5e62ee30bf66", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834310, "uuid": "29c00412-7bfd-45e2-b6ea-ccb3ee17a331", "comment": "Malware payload (STRRAT)", "value": "7bf3e5c405aec06816ef59e1656f4fb2588f4106", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834310, "uuid": "f22c798b-d261-4d51-8ffa-f7300d016594", "comment": "Malware payload (STRRAT)", "value": "83758dbfd94b9f1963d7b290055758213b27fa1d06c45ca05f7e93c284667266dd5da141afd01fa2bc365d764d05dec5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834310, "uuid": "9028e430-70e6-4fa0-ab5f-b1dafc936eb2", "value": "8FC31200AB9D1FB54C83CBA947A956D57E4F0D0792910C8D4BEFB3802A121FE58789EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834310, "uuid": "7e91b51a-8aa9-46f1-986f-7d095166fc74", "value": "3072:Jclep1KGQl7EIU8Tks5Et+1rAx6KvxwDAt7b6pcYZrKKKK9:Jclep1Fi7fU8C+1GlvrY1KrK9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834310, "uuid": "2e57bdbc-d0bc-4cd6-9fc0-dd49665dadc3", "value": 125504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834310, "uuid": "e889f986-5612-44dc-94b5-5bc0eebef1d6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834310, "uuid": "769d4c71-e93d-42f6-8596-504e07d514b0", "value": "Quote.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440d1a9f-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890113, "uuid": "117941ff-361c-47f6-b106-a372b59fcb89", "comment": "Malware payload", "value": "816c0602e76348e4fe750df600914692", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890113, "uuid": "5a472a4a-0a29-40e6-ac15-c7527e2edb06", "comment": "Malware payload", "value": "163629d069622db929ffca777ffa36ba20ca55a9c0aebee116a40c15ccdd5f05", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890113, "uuid": "0931c32b-f098-4fe3-983d-327d550ac30a", "comment": "Malware payload", "value": "3291cd5814b220e4fd2a7e5be75290646532004b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890113, "uuid": "7d7e426d-6b88-49d8-b53f-aa567e7f716b", "comment": "Malware payload", "value": "4d99ff6851579a0d2ce14a8be5403dc75dc49a0722673fc6dbbc253dfdd8b81349dfb8275860da65b9a6b22b34ff55ff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890113, "uuid": "ea2c9745-a677-4f87-a5ae-aa7061066c71", "value": "A1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890113, "uuid": "0c9ac1cb-5dd9-4d4f-a576-0b7e5fda01a0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890113, "uuid": "1de54a6c-4f14-4e1c-a091-f8e219dae525", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890113, "uuid": "d63855be-e692-450c-904d-2923104ada1d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890113, "uuid": "b0d97fec-20e3-45b2-9cf2-e7875153ce91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890113, "uuid": "646b064c-da79-4f01-b0e0-8d9e39aa276f", "value": "816c0602_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6414c7c-bca2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621869339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869339, "uuid": "071fe8f4-6119-40b0-ba58-9fb43be876de", "comment": "Malware payload", "value": "7688094ed5599dfb470463261ae00584", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869339, "uuid": "9b88ab7d-2662-4d02-87d1-ea7521016f84", "comment": "Malware payload", "value": "164da5270f1553909075fd790560fdc030dab11a92f57f98f7178c6e1f7dec34", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869339, "uuid": "753dbc5f-f870-497c-a433-525ea43b06cd", "comment": "Malware payload", "value": "a3df53dcd278adca576da51b8474f097ad540d28", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869339, "uuid": "91caad8d-ae32-4458-97cc-fcccb9104bf6", "comment": "Malware payload", "value": "c21f2d08f27b6426f309cfe1f9a5300298fbc2c37e3ca4e2f23abaf58234c4b3b37ced81c4c9194e0efc487b61fa1adf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869339, "uuid": "75f15008-5299-4ae5-be41-dceda5c704f9", "value": "29D26D111B4BA67605E08691BC039307FCAB9213E3345298B9EDCA9D1F421BCE66D7DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869339, "uuid": "69d9b423-4a0d-4898-914e-893c69260ec8", "value": "384:xIA7GWjDT2lzq8UrAM981lsNZxXS0YN3mRwnX3LNWCbxxuDzO9alcYmsY9gUSgsg:xbGhVuAMice39LNjuiZRgv2gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621869339, "uuid": "4811c283-7571-4e8a-b954-930a9001c21f", "value": 30412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621869339, "uuid": "c41013d7-54b2-4f32-844a-e0205970fa2c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869339, "uuid": "62039ace-46f2-43cf-82c0-84d7739fc80e", "value": "decoded 1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d36e292-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621850292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850292, "uuid": "dc8a96e0-11f8-4dc4-89a2-be0182386645", "comment": "Malware payload (SnakeKeylogger)", "value": "20db81da1471ee3550b45d32bfc450d6", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850292, "uuid": "83c317e6-a843-4c1d-bd53-4fe1f95d32ae", "comment": "Malware payload (SnakeKeylogger)", "value": "16666f1d4d623a9b3ee23b2f6ac3f85441c81e9be17d028530081b6a3991e47a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850292, "uuid": "d44cf3af-45f2-497a-82df-08436f35d7fc", "comment": "Malware payload (SnakeKeylogger)", "value": "cdb2d9886ce56e6e442e02639bfd1e01d6d94b5b", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850292, "uuid": "330de3b7-2bf8-45e3-af8c-a3fbd79e4dd9", "comment": "Malware payload (SnakeKeylogger)", "value": "0faa6d529ac35be0ef3e067c6c0ae2195fcf4dbcf71d0922a5213378a459e47001cb6270c729e10c245c890b02b04512", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850292, "uuid": "87136e1f-7a71-4fc1-96cd-d0238a063436", "value": "11B423E243057A16F7EA3714F4C391EE77628F6158D06464EEAE7410DD2932D3EA1F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850292, "uuid": "9802daff-b385-4ecf-a297-a0eba1284dc4", "value": "12288:SajBrNbLavXTVfa6ADAP9l7xDcFTyxo+PPYYgbVnN8rHCuxqk6:Si5KVlADAl0Oxo+PPYDj87CXk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850292, "uuid": "fce5bfe8-59de-4608-9e21-39dcbd681a48", "value": 519866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850292, "uuid": "46e110fa-2d42-4c92-a6dc-d7c7b13f7948", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850292, "uuid": "5bf7809d-1a5b-44ae-bb7c-17f9cea73061", "value": "MEDEL09435#INVDIAGNOEQUIP.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfa67af-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864923, "uuid": "3131865e-e4e9-42ad-9732-b38268019651", "comment": "Malware payload (Dridex)", "value": "6c7d0d7e2179d5a6acd6b09199ec8ba0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864923, "uuid": "eef01a51-642c-41b1-980d-49f51046b460", "comment": "Malware payload (Dridex)", "value": "16f2321010e31ef4f84e6e9c1fcaae5fcdaf542cdcd59ca4bf1caa86ace01e8b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864923, "uuid": "57f534c7-30eb-4de2-8a73-25cbcc0c6a93", "comment": "Malware payload (Dridex)", "value": "b943bbd99252ae5237fca6a8c6e77e5753716137", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864923, "uuid": "0af2a1c9-daa8-468a-87d6-46dfe3d71cff", "comment": "Malware payload (Dridex)", "value": "ccd1b32466f8a2d51b487fe430595e6dc621f75dafe850ff4ad1e2daaa05afd59be9956f7a1da3db25bca92133f41689", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864923, "uuid": "b5bfd199-1600-43a0-b05b-82d2a78ee1c7", "value": "89F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864923, "uuid": "8920f504-d546-4549-8de2-9c9976ac4af6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864923, "uuid": "94f5cd86-e1ba-4554-ae1b-6b151e70e0d8", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864923, "uuid": "7063f3e1-fcb7-4744-8f23-ba49c8dbd593", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864923, "uuid": "7c097c9d-878b-46b1-a356-e436320062d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864923, "uuid": "b5c69978-3822-474a-9b28-4ec0b95dd9ae", "value": "6c7d0d7e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a476432-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890096, "uuid": "e895bf6d-b96a-41ca-b706-cbee37eb0d47", "comment": "Malware payload", "value": "597b11e92570d63c6c5932c7d3d487e5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890096, "uuid": "8b461589-2807-4b98-a876-842fa67c231c", "comment": "Malware payload", "value": "17615a608c8e3dad4571b9f8501a4213a955f75908bf061a12e8ef91d7e2ab74", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890096, "uuid": "3c315a87-0a25-46d0-bf94-fa98a60be894", "comment": "Malware payload", "value": "a21837931df6646c8858413d7d629b515197b43b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890096, "uuid": "b56b9853-f025-4893-a873-4abdaee2f0e1", "comment": "Malware payload", "value": "bc1a96b8162de50ab3abdef3773996d9f74bb7ebde38d6663e5da9ea12815ecc7132b9776d1ab9736b8fd3ad99932785", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890096, "uuid": "dd9e54f4-e2ab-4553-a3db-5a01396e5d0e", "value": "0AF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890096, "uuid": "409e98b8-8c89-4db1-a46a-5d81706d713e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890096, "uuid": "ce115832-f83c-4d82-9b24-101d34d214d7", "value": "3072:6mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890096, "uuid": "64fdcfb9-9b36-4f14-bdb6-8c6ec9f09298", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890096, "uuid": "30279d2c-f70a-4029-b40d-361227be540e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890096, "uuid": "9263ce66-bcd5-43a4-928f-3305d8810c2c", "value": "597b11e9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df4c58c-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814511, "uuid": "d8a11c08-9732-4e55-a794-4d4e6d1c9c7c", "comment": "Malware payload (Dridex)", "value": "a9cc1359b9e68d19a72a94f61c0fa1f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814511, "uuid": "5d3ff64c-f51d-4abf-9b7d-25aba97d1f0c", "comment": "Malware payload (Dridex)", "value": "178bf09170f543a0cb64e02b60a6344f51e416ff17470db2f2e39380fc68f63e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814511, "uuid": "1a0232a1-99fd-49d6-a39f-7a02416f44c0", "comment": "Malware payload (Dridex)", "value": "7083934dd1e59701ad16f37d837c98327dc3874e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814511, "uuid": "2da3b39a-7941-47a4-a3e2-88af620a4e6a", "comment": "Malware payload (Dridex)", "value": "b7d0302e4fb9d873f6a96f533d064caad303933ec0ffdc9563a5f2c78c0edcaf249e83c0826e724141a282789ea55991", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814511, "uuid": "0d8e2631-8ac6-4ebc-9d37-06f64e3c884a", "value": "C7F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814511, "uuid": "1ef3e366-dd16-468d-8ece-dfee650b7ca2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814511, "uuid": "7998ee58-646a-4acf-929b-8aef06011c81", "value": "3072:lIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ec7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814511, "uuid": "a5449138-cd06-4bfa-92b1-653723ef5ab9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814511, "uuid": "334bc386-106a-4524-b13d-14800acfbaf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814511, "uuid": "857d8a06-1222-4c10-951c-4fcf0d8b2413", "value": "a9cc1359_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8f22bb-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825244, "uuid": "8ee00f32-39ba-4056-a922-ef13733b36f3", "comment": "Malware payload (Dridex)", "value": "2e4e7dfb7624a91fdaf0e63be1f99335", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825244, "uuid": "ba51aaff-c3e9-480c-8816-51dece94ddf1", "comment": "Malware payload (Dridex)", "value": "17cf4e4913043276d0eaed0669f57d93d70c968a37bdc8924d828e49da7aea26", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825244, "uuid": "809ce395-e89b-4e1b-98a0-c5d252dd4923", "comment": "Malware payload (Dridex)", "value": "bb94dea95b6713383c1a7d4aece657d7205d5787", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825244, "uuid": "d1305cf7-aff1-43b5-babe-92142ed9aa42", "comment": "Malware payload (Dridex)", "value": "a76c1feea0d29e98947f5b00a144aeea20918c376e28fc60c540c137db1da504ec3218cfa69684ef41b338f4f3912bc4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825244, "uuid": "55e38666-8fa3-44c8-8612-fe225e84ac27", "value": "8CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825244, "uuid": "adfdb012-9552-426a-be33-2cad6ab3ad4e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825244, "uuid": "9585e64e-b7c7-4dd4-90e7-6dbc1aa7fbba", "value": "3072:Mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825244, "uuid": "4d3e5f5a-d4cc-4e4e-a029-9ff7a886b04c", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825244, "uuid": "d1bfd815-ab0d-4d58-b14c-745f7336453d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825244, "uuid": "57e8cf82-b5f8-4ad2-9e9e-c22027440947", "value": "2e4e7dfb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ea67d9-bcd5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621891236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891236, "uuid": "ae997b99-1811-4e80-ab5e-16a32976d22e", "comment": "Malware payload", "value": "dca7df90fd3668b1667a0c804213b974", "object_relation": "md5", "Tag": [ { "name": "PowerShellMeterpreterDownloadExecx86", "colour": "#408BDF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891236, "uuid": "7a135189-f61d-4d39-bc0e-408c8a8f02b4", "comment": "Malware payload", "value": "17e1658921fb0e7e66ec5bfd92c8f6735d1b337f7f9121ec74517dfd438f6a0d", "object_relation": "sha256", "Tag": [ { "name": "PowerShellMeterpreterDownloadExecx86", "colour": "#408BDF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891236, "uuid": "3c882a11-590b-4bad-8437-1a4b9ba280ce", "comment": "Malware payload", "value": "17806de9be5b154588f7ded14d4cec5f111805bf", "object_relation": "sha1", "Tag": [ { "name": "PowerShellMeterpreterDownloadExecx86", "colour": "#408BDF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891236, "uuid": "9c516ee9-25f2-459a-916b-71b33a4ee6c2", "comment": "Malware payload", "value": "81f766aee9583a486cfdbd2994c5b4a791796b3af2ff6d7ea5b0e4d561960b36c9219607b3381fd8f5fd0683166c6d64", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellMeterpreterDownloadExecx86", "colour": "#408BDF", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621891236, "uuid": "74f29eed-b452-4f0f-8715-83cbd43cacdc", "value": "90128E563EA0BEA70087CB35398E56FAC8B7C125D68A204979CCB66CE4DDD7214DD3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621891236, "uuid": "c5503a83-accf-426a-b54d-8277042f7442", "value": "192:FdhXkttLDqDrzcC7dvnJFlxIkttLDDu+ff3z/:pX0fYJRI0fF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621891236, "uuid": "a61cb3d8-62cb-4327-818b-e4cc62449023", "value": 9066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621891236, "uuid": "bcbd86cf-1eea-4c59-a89f-65bb6813b854", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621891236, "uuid": "98c52dfd-59bb-4501-a3f4-a9a3ad0ed2b2", "value": "ciL2rxkQ.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0dca19-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621879090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879090, "uuid": "6e8c067a-a0e3-4aee-89fa-8e15f89a72e4", "comment": "Malware payload (RedLineStealer)", "value": "38d9e8ec4323b2346910bc2510be3877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879090, "uuid": "fff233d5-ad1b-4ddd-9832-7874cf29ada3", "comment": "Malware payload (RedLineStealer)", "value": "17f79bb4d041e0798a73fbde041570a0557d21d597b6106d14053387197b6410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879090, "uuid": "a094b992-1d4f-44df-b952-8c2fab8a61e3", "comment": "Malware payload (RedLineStealer)", "value": "a15db67eca00424b9890d6741ddf187cefdc8a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879090, "uuid": "d68c333b-15d3-406c-ae9c-210fa51d2876", "comment": "Malware payload (RedLineStealer)", "value": "bd64905f2d7bb533dde882ba3c27272322b2977264bb52cb1b892272acf332e31c68d6df5ebcec5b6969164e1ac77e31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879090, "uuid": "15c93771-8cd4-4fdc-863a-de8b9309c108", "value": "34047CBC3BDE2A46CB9C153EC9D0554483B1CD7D044BE3AB28C537E8249BBE6721274A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879090, "uuid": "f6cef7ff-c324-4ee1-af29-f42efb75a07c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879090, "uuid": "8b9bc637-96d6-451a-8766-2bcd3c9f0f5e", "value": "3072:s2gGlvb6JmJVLlEdiyAvyDTyzOpGd7F/7T5YknJg3kFl2T:T4JGVLlEdiyIy9p8d7T5Yag0Fl2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879090, "uuid": "403df8c9-95f4-4341-bbc5-f32e53cd5ccf", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879090, "uuid": "b7f3b633-5534-4292-9406-242368651e5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879090, "uuid": "af0d5d86-3993-40ee-a0c9-919c04d6add1", "value": "38d9e8ec4323b2346910bc2510be3877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4ac7fd-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868519, "uuid": "5b43797e-9cd3-4364-8463-35c066644e71", "comment": "Malware payload (Dridex)", "value": "8538ee5f4fbad7f78aff36a3e001bbae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868519, "uuid": "a55301b4-6b0b-4f4b-847e-0836a4a38c95", "comment": "Malware payload (Dridex)", "value": "17f8ddebdd58abea0da2b5f5fdc830e7141c205004aef5e578957578578b96ce", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868519, "uuid": "e82dcc82-795f-401f-aae1-ba2cc1600f61", "comment": "Malware payload (Dridex)", "value": "858304c8b807e3f9f218bbfc625009c15761a548", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868519, "uuid": "f87607d4-3a05-4ee4-827e-6e95141b2108", "comment": "Malware payload (Dridex)", "value": "325b745a442160bb7214e27134291baba1e4e99dca39e4c7ccee798efd9cb649bad9dd5dc4149f3ea10e22dbe7cdd6fd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868519, "uuid": "6f6a35a7-eec8-405f-8857-37cb3aa7c1ae", "value": "61F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868519, "uuid": "c0d5e46f-35bb-4120-b4ae-0356b43432b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868519, "uuid": "e4cac5c3-ef13-49cc-b7b6-25080aa4f84e", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868519, "uuid": "dd279c35-c96e-48a0-8ba9-c69b22fd4f5a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868519, "uuid": "593d4d2f-3b65-4554-ab1f-03a9b0c2d9ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868519, "uuid": "27336c26-07ff-4d43-91c0-2f5570e7a56d", "value": "8538ee5f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d524023d-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621886491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886491, "uuid": "8cde8f89-de6b-4ff4-b72a-1e0cc1c2de42", "comment": "Malware payload", "value": "5fdb104ec0a4d6430b9d7b50b030bd63", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886491, "uuid": "ad6a861e-0838-465d-994b-6eb44ee118e8", "comment": "Malware payload", "value": "1822749ffee42f8455ac80ec589396c29185b6229c4b688af011191342d58659", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886491, "uuid": "0bc27d63-f93b-4196-822e-8dab708795ef", "comment": "Malware payload", "value": "b42f438d9176be6ff7659189e028ef27ede9b1a8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886491, "uuid": "0fdf3b65-083d-470e-9071-7b5657ed3642", "comment": "Malware payload", "value": "5988eb882932a292a868ca8eb0f470aaf9e7841eddea74ee8f1f7f4e5c360f8869dda3fbd0969a2c12e0c8cc861fe213", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886491, "uuid": "8a2d0737-08eb-4eb3-a245-5e43fc158382", "value": "4DD5335B4E14C8A1736DD5DD804D24033DE9ED66AA6BC374A393CDCACA38A518FBC425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886491, "uuid": "cd763b81-f51a-4cf4-87f1-40137b95cf2d", "value": "49152:tP8gGKHFMlY3gl8bKCquNurBTVR8Pp32UQMkwCOJ7EpmvzJB39DHguXTcJzUA:tP81EFMlggbcMTVWPpmUQbF0F6uDtA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886491, "uuid": "9144d76e-e597-458b-b0de-43da726a6a5c", "value": 2766684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886491, "uuid": "d4b6b0ad-888b-4011-8bd3-ea252c23c880", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886491, "uuid": "06e851d2-b55c-45e3-974d-02f5e3c26835", "value": "5fdb104e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8cfdc47-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818153, "uuid": "5b36e00c-6f3a-4cb8-8257-d5adb95d531e", "comment": "Malware payload (Dridex)", "value": "c1b9d1bd831256ec6a6528e9cf06a6d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818153, "uuid": "8f9f7a3c-ac62-465f-bd8a-5d46e442138b", "comment": "Malware payload (Dridex)", "value": "18a20a1a59cc12613428b65558db6b47a1547da433c08ecab312107fa18879be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818153, "uuid": "a374ba74-dafc-4971-b2c4-9ed59cccffc7", "comment": "Malware payload (Dridex)", "value": "03fb4ea0737020c907bfe91138c4b6d93b4eb7fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818153, "uuid": "c93adc15-e183-4c25-a01b-e77493806914", "comment": "Malware payload (Dridex)", "value": "b9342ac147e82c9620e17c01df5f64098976c1bacd4bd163aefd1349cf51818413a261ae66996a4cb14ad07c6c5ebefd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818153, "uuid": "f97362f9-2413-49cb-b62a-aa44a511d3a4", "value": "54F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818153, "uuid": "265d1b69-bc39-415f-892d-de805deea3db", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818153, "uuid": "f9256541-c1d9-4aeb-88f5-e2617b0318a9", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818153, "uuid": "d9e8a85b-374b-4714-85f5-568eda908ef3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818153, "uuid": "ed726185-2413-4f28-8880-bf35ae916db1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818153, "uuid": "b229e88f-714c-43f2-a054-4079fed03057", "value": "c1b9d1bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def37abd-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897244, "uuid": "95f75aac-d931-4e7a-b5e5-2a66b52ca400", "comment": "Malware payload", "value": "e0d177c04fd99d007f945e79f76822f0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897244, "uuid": "1cd1ab9a-5c39-42cb-8eba-268f0145c628", "comment": "Malware payload", "value": "18eab651b6633cfcfe55baae009af61e3715a6070344d9b91e0e11e9cd1383b3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897244, "uuid": "7ec32843-9f45-4403-99c3-584a5dec8519", "comment": "Malware payload", "value": "4168c54afac813be07469d67d4a3d97c6b871f87", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897244, "uuid": "c85c15ec-102b-418f-81fa-c8644bf25494", "comment": "Malware payload", "value": "6f295f87156577b87e566cf8d248151ff074351349cec6138b38b692d3b5a3cb3b194ce93e59c6c58a52dba777abec45", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897244, "uuid": "f7e07ae6-7e19-49ff-bbe9-b23be8bcec20", "value": "D1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897244, "uuid": "5ede0a9b-bbf9-4677-bd68-a32d7f8daac3", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897244, "uuid": "5bc668b6-7851-4b1d-a568-6180813bab66", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897244, "uuid": "6259e41d-3e0f-435b-99a2-3cff95a99e14", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897244, "uuid": "9f356046-3dfa-4731-ac2c-f008d2845839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897244, "uuid": "06b2a036-ff7d-4d3f-9f5c-b53ed927fa76", "value": "e0d177c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ab98d8-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861336, "uuid": "39378eb1-4546-4643-9e1b-898e6ec21929", "comment": "Malware payload (Dridex)", "value": "7f5f6e89a5f3c92a7ab9f1413f5b9714", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861336, "uuid": "2744fb2e-f0ce-47f3-9979-676f1fa48142", "comment": "Malware payload (Dridex)", "value": "18f6ca23bc3f4e1f87c632e5fdd1add47fa83e20002d76b0570af551641891b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861336, "uuid": "d4d08e09-03f6-4ddc-8f44-8eae14789c71", "comment": "Malware payload (Dridex)", "value": "e4270029d0b500b3908a58b23aa1bd51031e5625", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861336, "uuid": "31fbca74-8202-4757-91eb-5a380df29418", "comment": "Malware payload (Dridex)", "value": "19a75b33cb206f5a5648b69f37d4ab7101fda5eb6878536597a9e5382bb0a1dc4363d54cbc904d8aa3101d7972637f68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861336, "uuid": "8f3e8c02-8f3d-4fd2-b93f-31c8ef77fe6f", "value": "6404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861336, "uuid": "5ffb0084-115e-473b-888d-3fc64e27338e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861336, "uuid": "6d257ace-5fb1-45fb-bd59-d3d8ee644e89", "value": "3072:CV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:CV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861336, "uuid": "35f325ba-d05b-4c0b-b9d6-f394200f5909", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861336, "uuid": "2fae6a54-2cce-4df2-9e9e-41ab158eb6b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861336, "uuid": "08ce2ebb-2dff-44c6-ab57-90fd9a506034", "value": "7f5f6e89_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe3792d-bcd0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621889079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889079, "uuid": "e70010b2-1bab-433a-b65d-14f1c621110f", "comment": "Malware payload (SnakeKeylogger)", "value": "6c6028a114004899f05ebb99e617d564", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889079, "uuid": "a9945a74-362e-40fa-88de-8e984756732f", "comment": "Malware payload (SnakeKeylogger)", "value": "192bbfa8e3c759ddc7ed82a348d81b2a8ae2bd2f20242bfcc72d8d227a35e858", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889079, "uuid": "951c0018-85e6-499b-a841-68582bfc7d4d", "comment": "Malware payload (SnakeKeylogger)", "value": "4a5d7f2ac1a8a82ac04384c451a6e179934c7e3c", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889079, "uuid": "32900230-c368-4de5-9b0c-1c83f81b7bbf", "comment": "Malware payload (SnakeKeylogger)", "value": "48eb0dc1eeb82bc4dcca2b7062a55c0c43194ad4ea8c6935d43bdd4d4ea62260bb88904090e7eccce95e20b19e6cd825", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889079, "uuid": "9e52419d-e8a3-4d3c-a179-c005a2d3c7e8", "value": "BDC4BE4B3E9471BED773CA3F89641D10A6247C6692D7E207B40FF19C0D3ED968A206E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889079, "uuid": "0aac5f0d-8d85-46f0-90c8-e7e2335bad49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889079, "uuid": "9ef97d5d-cb18-48ab-ac9c-cfa10b6238d6", "value": "12288:QP9cmhoKsppjeH758r1k7Q9rizr/A7AJdfX4oy5YPiElCzpnsG3q1:u9c+w1eHt8yQ9YgATIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621889079, "uuid": "24e6b636-f708-49ea-b8e4-b82c8fd7a2ee", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621889079, "uuid": "61573e92-ae1c-4a37-bf0e-82f9bcff48ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889079, "uuid": "599c7f2b-8f7d-47c3-9671-283681829bd8", "value": "4545344-858575655-47765 doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b83f31-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897279, "uuid": "1276cd7b-3886-4c9f-b60c-e0142364b9fe", "comment": "Malware payload", "value": "6e7fe01ce0b85a4be83008d43865b93c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897279, "uuid": "d6d01df5-c08e-4b0d-8524-96d882ee44a8", "comment": "Malware payload", "value": "194e12a4523e0a6a60352322b3b7cad31ad4d10d91039a71a3962272ebaeb976", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897279, "uuid": "32755b41-6ea8-4f65-a5a6-d33bb69af93f", "comment": "Malware payload", "value": "6f149a44b8cc02f957fe5c4daab179648353205e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897279, "uuid": "37c1f010-b07f-47fd-a320-d0deda2a80a5", "comment": "Malware payload", "value": "c973b5dceee05a286959a346a27d7981c923f9d53875d6b5c133cb89ff0173b8f88779d92571b25dce3ccd3497ddb9af", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897279, "uuid": "22478a7d-e333-4a84-b5f1-26455dca62b8", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897279, "uuid": "858b2158-afa7-47c4-96a6-7046fd69c773", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897279, "uuid": "94f4e318-750b-4d69-bc57-960bc66a1eac", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897279, "uuid": "6b029f13-4509-4e7a-b60e-4ea896bd9bfc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897279, "uuid": "59f96f9d-56b4-4fc4-ab04-273207e64973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897279, "uuid": "df143906-8139-4341-95ff-1fee825b415b", "value": "6e7fe01c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1cd4f9-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872065, "uuid": "f14fbb9f-7f90-4a00-a55b-1147e34cac58", "comment": "Malware payload (Formbook)", "value": "66c28c55db259c475c093be83ed59f25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872065, "uuid": "6c206022-106c-4a4d-bcfd-1ed4be016303", "comment": "Malware payload (Formbook)", "value": "1a958bc3c23bddb2cf9c5e9e83cead12d09701e887975986522710361af0b924", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872065, "uuid": "7e64977e-fe51-46b9-8f19-1e8c3bce2296", "comment": "Malware payload (Formbook)", "value": "ada85334169b3d6477521251af01b3e26e129903", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872065, "uuid": "12db8b33-c48d-4ebd-b3fc-4f7eef9fe0c1", "comment": "Malware payload (Formbook)", "value": "ae2b1e8f5fee59c523ec1f11ab7c101fe0ec5858b28f75c30f0002e4141141c8879503d2610ffbddc2b62378ef2ccff5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872065, "uuid": "c00e1698-3555-4f47-a90c-42a3eb264598", "value": "BB04AE32D652C071E2B251B4B67D1B7B883E0D393295A4E9E3E116E06EB09E5F42D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872065, "uuid": "c178970a-8a86-49d8-98a8-a95f6f93c0f3", "value": "3072:FPBJpOqYtrNX1rZGNcNjxLHFUWKveEsvOoYGw0wgHtkQue:nJrYTdZecNNLHFUWfEsvOTFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872065, "uuid": "46329b9b-47f0-4c74-87a2-42b82e24c6ab", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872065, "uuid": "3e5c5d24-7e52-4a31-a2eb-018f7c9f2b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872065, "uuid": "ab6a026b-2858-4d72-8bfa-9220e596ea0b", "value": "66c28c55_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3b7de2-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818129, "uuid": "b8a7f359-5b24-4139-9e84-39ebcf40d813", "comment": "Malware payload (Dridex)", "value": "3b5dd919e25fa3843ce516e89030a4bf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818129, "uuid": "c5721164-0a66-4392-973b-647534b341c1", "comment": "Malware payload (Dridex)", "value": "1ab2e17cce1ff4e8ab6e9c1f743810ba4c84343d054e88ef632648e1274c6fc9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818129, "uuid": "8be1d8c3-9ec4-4370-9f27-75c8a9e4b27b", "comment": "Malware payload (Dridex)", "value": "0a96b20ae00d5c4dc25335b521346405637d4c9a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818129, "uuid": "d0909dbe-32e3-4b3a-a3e8-d2146176ed28", "comment": "Malware payload (Dridex)", "value": "daf64bc19edb40ff99cc160297eac4b501c819c1d5dde98db646f5b2009cdc1e8385c68430fe3969708016a5763dd0e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818129, "uuid": "57910c15-b254-49cf-8ded-896216d72357", "value": "FBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818129, "uuid": "ac4a2c70-703e-439f-80a6-274565092239", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818129, "uuid": "12f6d26d-8b9a-426c-acc8-c8efd05f6900", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818129, "uuid": "83f91a88-283a-415d-862f-4c95bf13b66f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818129, "uuid": "9150c251-3e5e-4ea2-a0a2-aedfcc1fff17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818129, "uuid": "c543a7bb-f4e8-4b6b-8da5-4a6bf075ec06", "value": "3b5dd919_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51da01e-bc58-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621837555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837555, "uuid": "1b7054b8-0a5a-42d2-8fd6-eb535c400bd6", "comment": "Malware payload (RedLineStealer)", "value": "c29884e94437acd699779609819d4851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837555, "uuid": "2228f040-fa21-46dc-a73e-8e572a415668", "comment": "Malware payload (RedLineStealer)", "value": "1ac03c1e098aa881d52b14a760d52cb9da9b6e7e67db9677b9b7106a4cdfc8e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837555, "uuid": "044550f6-5494-49c1-b2ff-59f0ce6b0079", "comment": "Malware payload (RedLineStealer)", "value": "b7e98134a12cc80264aff29b0acaee77090a1079", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837555, "uuid": "ee86cfa6-2421-410c-813e-fb750f5863c1", "comment": "Malware payload (RedLineStealer)", "value": "03c9116207bc56f0384feb8f78d29296833269cd093935fcc392beee65705d79e388a3bcfacbf984ff1d083adc7b0228", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837555, "uuid": "6a68285d-f3dd-4755-8886-c6a0c96bfdd1", "value": "A2B4947A339134BDD0C16E75F20405F0A9E65CA329EBE855663FB0FBBAB94D421A3C14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837555, "uuid": "e767d2cd-715f-499c-b40d-c9b6a8c81514", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837555, "uuid": "084f7503-2a15-480d-b049-81c47ac478d5", "value": "6144:CB8ejdQMVESWBMYwOR/ZujY3fKoHuyzRRRRRRRRRRPR5fzLAn0jlG4:CB8ejdlV4BMYwOn2Y3fKoHucLLA0jl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837555, "uuid": "5937508a-7746-4c5a-b567-fe9d05a6f5c6", "value": 505400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837555, "uuid": "1d841ed8-c084-4770-854d-be290dd15476", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837555, "uuid": "4bda2109-8f87-41b3-8f1b-34e8fbd53e7d", "value": "c29884e94437acd699779609819d4851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52e65d2e-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879400, "uuid": "6c6a8a91-e6ea-45c7-ab57-966847aa6d1a", "comment": "Malware payload (Dridex)", "value": "beaf152ffcf22b13e82d11be2bf1b415", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879400, "uuid": "2e6f9b63-804f-45a9-b924-2f86b8ab9309", "comment": "Malware payload (Dridex)", "value": "1b1fe466114dfe534582dbc2af8ee79cf253c872333a5241fcdecc82a69eb568", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879400, "uuid": "35a57fe0-f401-4b95-974e-735211755c32", "comment": "Malware payload (Dridex)", "value": "056d92712c0b7b3c9389a05d5db0cc32d5ec224b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879400, "uuid": "35b707d6-09ee-4062-8fb6-c6c463da0bb8", "comment": "Malware payload (Dridex)", "value": "1ee5476bea4fe8772abae28759b980173f543a62ff01653e2aa461ef12dfcb28bc67f249a700b161b8848f13ae00bdb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879400, "uuid": "c153bcfb-6dc8-48a3-a059-0b00bfec07ba", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879400, "uuid": "54aa4549-da60-4879-bed3-a2477f6d4e54", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879400, "uuid": "c5f6af18-0786-49d0-97b1-f0b9fcfc8c6a", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879400, "uuid": "26648ff9-370b-4e72-8d6c-70071aa205a8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879400, "uuid": "e848d515-6381-491d-964b-9785e2806ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879400, "uuid": "8aa9ea3f-f642-4b0c-b1bd-82bee218c30d", "value": "beaf152f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98925e4c-bc8e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621860619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860619, "uuid": "7c601db4-d3c1-469d-b9da-765076ea0c0c", "comment": "Malware payload (AgentTesla)", "value": "6c399f8ae29709b63a7dab8b857a9bea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860619, "uuid": "0eb4bcc3-1dbf-49f4-a756-457a7230c95e", "comment": "Malware payload (AgentTesla)", "value": "1b5481fd1d8915ec5af5012c0e576e1d2db50e24d8c27d785e6e615274731e43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860619, "uuid": "d9508989-ad74-451a-a822-ff450c9546a0", "comment": "Malware payload (AgentTesla)", "value": "c52807c9f6a4cc80716fc56050c860d8d6ad1543", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860619, "uuid": "cc0b3fca-6734-4f6c-ad26-c3b30ab98fce", "comment": "Malware payload (AgentTesla)", "value": "75aad68f7c0c4877831b3cecabc4a22c0ae422c7aa88e5aa207b0a2ab778d909ec7af884ba8df8564d1486bb5fec28b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860619, "uuid": "7d421f3d-8d12-4087-8f5d-786df7a575e7", "value": "25B4DF5D37A0B59EC4679E32CAA42C20EB30B866572BD30BA047166C5D5E7DBCE107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860619, "uuid": "6b8c26b5-57a0-4a9f-871d-8acd05b0431b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860619, "uuid": "e0c46032-d65a-4f58-b86b-1b2d6d54d4b4", "value": "12288:bhmy0w9GHdPV1HjeYF3W6Kf+/GgBtQeez/:T0F9PV1HTtR4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860619, "uuid": "f02b91af-db76-4654-8880-67e4918b53f4", "value": 517120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860619, "uuid": "dcb9ed82-7e72-449a-9175-2e2a2b4bb170", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860619, "uuid": "5cd76259-1abd-4d7e-bbfa-6d38636f09bc", "value": "Shipment Document BLINV and packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea292e1-bca8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871796, "uuid": "958e9b1d-11ac-46fe-a15e-8c8a16748709", "comment": "Malware payload (AgentTesla)", "value": "94f92f039066242703a133dc48da73e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871796, "uuid": "5b785dbc-a7c3-4edd-a9e3-282ae67c5152", "comment": "Malware payload (AgentTesla)", "value": "1b5f7e3c38243fb9d77e6ae12cc72f1aabcbf9cc083ef585f24ee9e898c19a88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871796, "uuid": "ec913aa4-49bc-4db9-9757-f9d0c85e9a9a", "comment": "Malware payload (AgentTesla)", "value": "ebe1a43b5fdfda03a45bd8cee43402a7beb138db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871796, "uuid": "5be7f8db-b2a2-489c-9f1b-34584248993f", "comment": "Malware payload (AgentTesla)", "value": "c9999c7b0b8b37658935bc2211f4634196e9c50f85ca5bd22f8f579074b7c1ac50e5a8ff5f105347818f9cef2c505724", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871796, "uuid": "728f338d-8f9a-477d-a71e-2dce63e37454", "value": "76358C2C112EF122C2A8C2794AC4953BD560DF377531BE19ECD737986B39E41B89227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871796, "uuid": "0fc470f4-928b-4c87-a96d-3d5f0c3d2548", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871796, "uuid": "2f3fcb95-76fd-4187-b7e1-8ecdb3bd42d4", "value": "12288:h69BCDCKkk8Klm2rzAx2rEI0cjoxGPuRDBTWJCR8Vvo1I1hUB/6fCpZTVpMjvLe:2BCDNWom2wx2Z0s2LzKo1E2tRppyvLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871796, "uuid": "3f665654-2c45-4cde-be39-d918f705f0bf", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871796, "uuid": "e3690255-a122-4b3d-a799-eeed0ee5f4d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871796, "uuid": "09806ae9-4c1a-4b66-b0cb-d32d9c735beb", "value": "ASTRON POLYMER - Po Number 241201324.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2618df5-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (SilentBuilder)", "timestamp": 1621857710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857710, "uuid": "b461ed01-15dc-429a-a84b-b081193ae825", "comment": "Malware payload (SilentBuilder)", "value": "5a3c88eae5632df95462797ca944d968", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857710, "uuid": "ca484627-d077-43c0-bdf6-98acc01c8dea", "comment": "Malware payload (SilentBuilder)", "value": "1bcd2386ea9ec8aedba137c548c9383b1ca5658ccde424d19f655f211e811f8a", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857710, "uuid": "d26aefb4-139a-430d-a35a-d2b5a2bb8a24", "comment": "Malware payload (SilentBuilder)", "value": "dd576afef236e9db1d6c3c2374b44546fbf5cd25", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857710, "uuid": "5c795e97-c7e5-4abf-add8-dfbda0da7a2c", "comment": "Malware payload (SilentBuilder)", "value": "d9e9851ddbcd93a2961151af794237ff22a124e0feec88006a7634882d463b2c86892724b270b42283a5f8241fd418b7", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857710, "uuid": "e68d2b45-51b2-462f-8484-bf7d2bae0bca", "value": "3FB49D42A309D4A9C3614B3AA5118AE8556BEC52860EBF43374BBF2CDFF4390F718765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857710, "uuid": "f6800e39-52b0-4d6c-bafe-1d677732bd25", "value": "6144:C6tIrWqrY5O3NMHGRYc9u/YRTP85XbXu1XYiX20:Ru1XPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857710, "uuid": "5a22b43e-0a5a-49a0-b6ac-591c28f5e5aa", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857710, "uuid": "a8da95f2-f23a-4d41-a1f1-4289a9a3c990", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857710, "uuid": "97982e3b-b3c5-4837-851f-207dd83cca81", "value": "5a3c88ea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e8c550-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832501, "uuid": "a7635bd7-e796-4bdc-b043-fcdf4330478f", "comment": "Malware payload (Dridex)", "value": "fe3e05dc7c00dbb8ecfa4e9ee6c94203", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832501, "uuid": "aaf05be0-7cea-4211-ac8d-3050a4bf548e", "comment": "Malware payload (Dridex)", "value": "1bf93fd0905d504ca500ddb5b4159b0848573a33f3d5c41b65243ad1fe3e5072", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832501, "uuid": "ca1641ba-aaec-4585-b3e0-4e3ec1f26465", "comment": "Malware payload (Dridex)", "value": "6cb62cf6e081549da30741834995a5aadae914de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832501, "uuid": "899d7a30-d92d-4a34-ac71-5c1b63cdf5dd", "comment": "Malware payload (Dridex)", "value": "2c8c4d1804e1a5e5b2f0e10bb7dbe990d124d145e1fe2b894ff08c6bb5efdc0eddfb8069a9a907370511fd01f1f0b575", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832501, "uuid": "44863499-1e39-4350-89c9-96ce8e79aff6", "value": "46F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832501, "uuid": "8f10df74-2b15-463f-b909-b91c1c8f83df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832501, "uuid": "842844ab-518f-4fe4-a269-3fd5744defb2", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832501, "uuid": "780ffb3a-b443-47b2-aeca-9c81036bbb3f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832501, "uuid": "6e464a14-a7d4-41df-8a60-c58d6adb3c4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832501, "uuid": "36d76b2d-7f6a-4f9a-acfd-730f48621079", "value": "fe3e05dc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01330d31-bcb4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621876686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876686, "uuid": "f454b298-c764-4573-8f16-cd37da4cc882", "comment": "Malware payload (Formbook)", "value": "6ab96e3529b17180141109a469eb5a43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876686, "uuid": "7c7ec2e2-6c34-423a-be7d-6053b6f9e1a7", "comment": "Malware payload (Formbook)", "value": "1cb0c85a07569475b00ff82ad4b7f651c3fafaa1beaef1d4c7a86cfa56bfdb5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876686, "uuid": "ed374969-365d-40ad-bb7d-ea6c54562848", "comment": "Malware payload (Formbook)", "value": "98bae1c8cd2881352c82a51c75320a13f680ac46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876686, "uuid": "2384b88d-9715-4d4b-9a01-e2c8b5332f3b", "comment": "Malware payload (Formbook)", "value": "0ab739530a3b3b245028c59974a71012b1549ccb350220494be7ac1063bcb47bae29a499daedb6a4091ed63ef886cd42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876686, "uuid": "0da3fbab-2362-40ba-9530-0d6c21b88e72", "value": "B435AE2C612AF126C2A8C2784AC5953BE851DF7774307D1AECD73B8D6739E41789223E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876686, "uuid": "852eef4e-391f-4d5a-b89a-fe9c530ac2ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876686, "uuid": "c4431d91-29fa-4b64-850f-609823423ea2", "value": "24576:Bls+h/xZqlVsY3GL9AOVtVd2ilM1xydvLe:/s+piVsYK/HdIydvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876686, "uuid": "c65f9ea7-8e25-452d-8120-6ff596a48e00", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876686, "uuid": "f06d5a95-22ba-4966-8c82-d07097aea925", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876686, "uuid": "607bad3b-e636-450d-9ad4-a9e15a8aee71", "value": "bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6fb5130-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868455, "uuid": "77fe9ead-edb4-42df-9930-10eb14a95287", "comment": "Malware payload (Dridex)", "value": "af7a49f5aaf2e1b430eb0622668291ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868455, "uuid": "b6d735bb-300b-448c-af2f-9024584ba557", "comment": "Malware payload (Dridex)", "value": "1cb4b3fdb6f2d8b31dd33b1d437c415d6481571d8376d09c5f617a408caf4d1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868455, "uuid": "45232f36-276b-4095-9932-1479b598f898", "comment": "Malware payload (Dridex)", "value": "b66f8c625bcc574b70c2d4b46ea32044341e8252", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868455, "uuid": "55791fe3-f92d-41e0-9ca8-9a3e8dc1c2cf", "comment": "Malware payload (Dridex)", "value": "dc7baf8f5ca3e2bcf5b6456f3413017df402f508bb103966165b1cb4bbbf77aded79446be42b8a8c73a304e0d31b9b67", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868455, "uuid": "b27b5396-f75d-4fe1-82f7-aaeb1adb7c4b", "value": "54F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868455, "uuid": "1f4c7b93-f9e0-47a7-8e57-91563f43e1a0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868455, "uuid": "a4697575-439d-4179-a787-bea7d454bdac", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868455, "uuid": "8cb2538e-00f4-4594-bca4-20faa6394e9f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868455, "uuid": "42db4e03-8b95-4e8b-981d-2f0f8ec2d805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868455, "uuid": "1f620b8b-8b97-4715-8e5e-9bf997b98734", "value": "af7a49f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e98c4996-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850447, "uuid": "fa98442d-15f6-4190-bea0-3364350232f9", "comment": "Malware payload (AgentTesla)", "value": "d1c7ad2c5c731b27eb2b43cebb91eca2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850447, "uuid": "1b3fa176-db5c-4c0d-b3bb-82c77f999445", "comment": "Malware payload (AgentTesla)", "value": "1cc002ccb2341e5d8cb430fed427636cdf777b66a40d55f96e92726463cf9bbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850447, "uuid": "b74bc1ce-03c8-49f4-b827-46242f960001", "comment": "Malware payload (AgentTesla)", "value": "797c0a367e22366d200124c63fb13b836b765258", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850447, "uuid": "0d3ad947-0ad7-4655-939a-a0da2d9410f2", "comment": "Malware payload (AgentTesla)", "value": "f0d9c6207dc5706d6bc297acaa8b4f5291e33bf24fb47bd25b8ea7fb7445cac0c5f3baf892941547eeb947d25966f946", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850447, "uuid": "feaa334c-7ec9-4077-8fbe-1d7e2771ed6c", "value": "B0B423574BD2B70366434EEE01C2EA2C6DD1163FC8FAC6389615E92298D78D4D621F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850447, "uuid": "4b055895-d860-4b33-807a-88f3929b8d24", "value": "12288:E0lRC5xq0GuiLxXimvmZVWC78Wtie8mplY+uSGdZzKxcX:E0DTruWxXCnJ78WUe8M58TzKxcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850447, "uuid": "4eff7b66-22ee-45d0-9641-e2de5f0a07e1", "value": 495014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850447, "uuid": "9d6171a8-55f8-4749-a13a-579cfa602fde", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850447, "uuid": "e6e5dbe2-8f34-4a18-959a-7d2ab2d11593", "value": "PI-ADVANCE PAYMENT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f5bfec-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872538, "uuid": "29575634-c264-41da-b684-d41742c7a056", "comment": "Malware payload (AgentTesla)", "value": "17b725f2e8bd86028243c28224ac4b9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872538, "uuid": "d522972e-551d-4cf8-9f1e-d9ed5b5b2d6f", "comment": "Malware payload (AgentTesla)", "value": "1ceadc04d4c307c8a55165558fbc09995b699ee4180f0e9ca1a69e502561e075", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872538, "uuid": "979b7e46-aa38-45cd-aa26-9a7b567be006", "comment": "Malware payload (AgentTesla)", "value": "59187c3348f9ee4c552699a933f11958d3f1c0a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872538, "uuid": "ceea7ba5-d005-40d6-a7d6-835b0c58bc6d", "comment": "Malware payload (AgentTesla)", "value": "6d9ea7ae57b2d7cf555a45ec91cfd6c5b5af3acab9f8e4feaaa496fc493d1f1a89989047d212da56caddd51f96720458", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872538, "uuid": "5c106821-0979-4665-bad8-b3279202ed28", "value": "7B15AD2C116EF126C2ACC37D46C4842BE590D7377132BE29ECD7179C5B29E80B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872538, "uuid": "9fba57d0-61c7-497e-b970-79d7dab3c54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872538, "uuid": "763ade7e-a881-49fb-bce6-67d6cf5bf895", "value": "12288:Bv0LBCXrTAS6iNYAstkSQQ6jhQs8hD4zSku8Spj6vx/kXRD5as2wWcG3:GBCXXAIYAst6jWs8hDFkpS06XSp3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872538, "uuid": "33b9580f-eb2f-404a-aa32-ad83c05b8df1", "value": 902144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872538, "uuid": "ab01da0c-6381-48ea-9112-5a9662bdeffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872538, "uuid": "618e7cee-b09e-4732-b8a3-836097bd9931", "value": "New Order PO KM19-141657.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03c6e065-bc81-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621854786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854786, "uuid": "00ac6e73-751b-4dff-9074-cca4cda66b11", "comment": "Malware payload (Formbook)", "value": "db4075a54a023932c806f7778b572700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854786, "uuid": "62a7450a-5f9f-4bdb-b041-dbd821b6447d", "comment": "Malware payload (Formbook)", "value": "1d00cbdd1852bd0d5c3771775a6fa707847b00c521a04036c2752d798e9a7bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854786, "uuid": "2f658d1a-45a0-4fa0-b1dd-6f8c05889bda", "comment": "Malware payload (Formbook)", "value": "8dc47948774a4600e3c54b35cd5ad3cfda926a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854786, "uuid": "995f695d-11d3-48ef-9719-1e73ade70fa0", "comment": "Malware payload (Formbook)", "value": "a87dc432ba155f09dca4e3796a4a9abbccb1e12d13d88f578e0600d4f963a30c9ed40014d3389e5d15fb3190e7f4d863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854786, "uuid": "9aae599f-d5be-4a97-9e8c-6a36f7ed41b9", "value": "5B34121022F1D0A7EE5A16724A734A61BB32F7792C2105AB2B744EAF5D706CBE5530CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854786, "uuid": "f1e8b5df-03e5-44fe-a873-f4fbab564a6d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854786, "uuid": "fc583391-f6dc-473d-a5a9-62df28c5958e", "value": "3072:LQIURTXJvgjMmNNaX3AxGyFs2aNYk3BXhs1fINnC9JvnyE58WGPYG5BwVyAXgIao:LsBmhFs2axxshnyE5hGP55BwyARHlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854786, "uuid": "1e1fd10b-1466-40a4-921f-5f6deca42be9", "value": 239232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854786, "uuid": "10e900f8-3edf-489c-a7c5-67e4b90b24c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854786, "uuid": "2330de39-a4b8-4a5b-ad92-744047208db5", "value": "INVOICE-1322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681c3b88-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836056, "uuid": "e9f3a8ec-eb6c-4dd9-bd1f-0f8246ee3d9c", "comment": "Malware payload (Dridex)", "value": "1b4804ada3defa75853fdf94f9100789", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836056, "uuid": "c97d20db-57bb-4487-b726-908ccad97541", "comment": "Malware payload (Dridex)", "value": "1d071f7018850d619eced4c4545766feecf97d94804c099be116ba4dae277311", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836056, "uuid": "0fcee0f7-43d3-466e-9c6a-b81247aeaf1a", "comment": "Malware payload (Dridex)", "value": "d2788d74798f4b596e0c0681a5a7d742e8fe1382", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836056, "uuid": "6d839bbc-732a-4649-800b-9d175fc57ae8", "comment": "Malware payload (Dridex)", "value": "2dd24a3d03dbe030509ba91306287671d002c27eaeb629e413f3a9f2f0285e94d8cadcd63b2fc734df1901506e6f88b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836056, "uuid": "c90e91d5-3bfa-48d5-9879-e1b123af10b6", "value": "1AF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836056, "uuid": "503e74da-5a2b-40ec-8a50-4775e363061f", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836056, "uuid": "9aa7cab4-7522-40e9-9176-5a36d7c20cb0", "value": "3072:QiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:7eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836056, "uuid": "9a5a8e35-2700-49f8-a3c1-41c588c596b3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836056, "uuid": "1a455b42-fdb7-48df-9a41-5bce47ecbe5f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836056, "uuid": "c677cebd-5a2e-4722-8549-e83a489adac2", "value": "1b4804ad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0803a754-bc9d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621866819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866819, "uuid": "c4741ec3-6dfc-4387-8e7b-9fd4aaaf6726", "comment": "Malware payload (AgentTesla)", "value": "dda118e94e50d6e4bd9fb9f1476b4f2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866819, "uuid": "031c78df-cc4d-466a-9fa1-94e5e0b65d7a", "comment": "Malware payload (AgentTesla)", "value": "1d0f9f608a9259fdb2f023365da66ed0726da7cfeffd7683a3ab8789eab41d99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866819, "uuid": "32ceaea0-524e-435c-a9d6-069b781cff09", "comment": "Malware payload (AgentTesla)", "value": "6fa97c25f74e121c51e7c198dc4e6ccf643215ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866819, "uuid": "74f33cd2-ff07-4a16-b814-6612a2de200c", "comment": "Malware payload (AgentTesla)", "value": "8866dc772b2089f40b32f45fc6acacbe6ff8042e99a4de348b7206c812b0e5ee3df7659e46bdb39324040864432d8a8a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866819, "uuid": "eb2c625e-66fd-4aa2-92ff-0f19ad158e59", "value": "BB35CF217798BBA9E97E8B390860904013F2FA07DB29D74E7C99118E1D21F56C773B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866819, "uuid": "c59c47c3-6a21-4fef-9bdc-f46e04e49fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866819, "uuid": "f41cd383-b8a7-4e39-b45f-f058c8893b2a", "value": "24576:Nop3sc6JPFlhmSecRXzJAAhMlO2JyOkhz3:Q8c6VdmSeaxITyLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621866819, "uuid": "3b8f796d-df5e-48b4-9104-e5d123ccf497", "value": 1075712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621866819, "uuid": "0bbcdc5f-ab3d-4291-8f21-e116fff65329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866819, "uuid": "a2f56138-f87d-4ed6-9e6a-7f01fc7be972", "value": "Scan 2120021 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aea51f3-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843255, "uuid": "0e5759cb-bbb3-460f-8fc6-fde9897a86df", "comment": "Malware payload (Dridex)", "value": "130e81802105be53c9a2dfe50a6df1a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843255, "uuid": "dde37407-1b87-4ae9-a885-c29383f06931", "comment": "Malware payload (Dridex)", "value": "1d19f1674ed2c437aa84922508b9d104bb1eebe7e27edf1e97775a2585703756", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843255, "uuid": "571eb49e-d20e-4ebd-9aa4-b15266baa29f", "comment": "Malware payload (Dridex)", "value": "760790fb5cf9cc4a2ee67aa374e7b424d8261192", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843255, "uuid": "01da7091-d403-4ca6-81a5-1c5dd80921cd", "comment": "Malware payload (Dridex)", "value": "0602b4965e6e00add1f0ae5d95eee5d1f2e0af5b7bad821326a0b17a07529331d030073ca58762451932a7e59f956eb8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843255, "uuid": "e3e18a3a-ea8d-426e-b0bd-4c40398ce4a2", "value": "8DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843255, "uuid": "e3c7bb9f-ceb5-410e-a5cd-6a75d0da977b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843255, "uuid": "18d7242a-f9a5-43b9-bd60-2ff92b1d403f", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843255, "uuid": "7f127c1d-3baf-4faf-8298-0db09774d1c7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843255, "uuid": "b4c62763-c8bb-4ef6-bf9b-6972f3cb8c57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843255, "uuid": "bc2951f1-d9f8-4aed-aca6-bd957d0b9ec8", "value": "130e8180_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dee1ff-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621838420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838420, "uuid": "5f0eb52d-36f7-4e36-84fc-5730e5b2991e", "comment": "Malware payload", "value": "d875d447eb9423da80e55293d69d9b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838420, "uuid": "22eb211a-0db4-4552-8083-6b0d46943d7d", "comment": "Malware payload", "value": "1d1c6ff426636c1f9fb4349c93680cca8624aa80c5fd16fe7a38900464d4bc14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838420, "uuid": "e4969f9b-fe90-4348-bd66-83e644e53df2", "comment": "Malware payload", "value": "d5affa66cb5fdc836eb5d5a93a17570b096bbc4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838420, "uuid": "9e09c9b5-8475-48ff-afd7-ac856c6db9e9", "comment": "Malware payload", "value": "af03b0a04dad89f67ef116f0d52da6f4d051eac3e9429c127e1b6163dbb58eedb66635729dd3f9bc226c2e3b7846b4cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838420, "uuid": "53b48499-ee4f-4ac0-ac40-a2e82cbf42de", "value": "93444C3066A0C035E4BF11B489B982B875397DA16B3480FB6EC63AEE55345E4AD30F4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838420, "uuid": "85597c2b-0e9f-4085-85f6-2c5f30e2669b", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838420, "uuid": "6e4aee1a-3e0a-4dee-adf9-2dfd8284c3b0", "value": "3072:fSGGGx/eXKnYuA6tKFxrlWXUHqCGXFo0/MXBZSqy69w7xcKZHI/pXsTRV:qGVx/e6n3tKXrk0q9hIneCXsTRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838420, "uuid": "19f1c4a2-e9c0-49fa-9181-c14862a61a1a", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838420, "uuid": "b52deede-2a21-4af4-b743-fffc152feaf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838420, "uuid": "940f1e3a-89a1-464f-9389-730819966031", "value": "d875d447eb9423da80e55293d69d9b9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75d4bed-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "aca66376-7237-4238-8315-24f65540dce8", "comment": "Malware payload (Dridex)", "value": "d0dcb59d3fe1971dd96e247672188b44", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "a6562f9e-5118-4afa-a8c5-2455bb9b09d6", "comment": "Malware payload (Dridex)", "value": "1d99e5fed0919f563ea25d382adbc630ab45cbd7a6999d2822cc3424003924db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "fcf39216-9c55-4171-8af3-01ceb0ed380c", "comment": "Malware payload (Dridex)", "value": "15c7cdb6f2945b02bb472fe64f958a6163bc8cd1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "de4e02e4-8bf0-4ce4-8f6b-61995e6b8844", "comment": "Malware payload (Dridex)", "value": "41586a1a2d4f677675923226c01d000063fe568c5d8e7b88e705982088cd7ec56820fc1fe398db2b9f7d710fbd7f305f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "74f45cf2-863b-4abf-8417-8872a7c9c5ae", "value": "1FF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "5f51d3e9-f947-44b6-ae42-12b206d67317", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "045905d8-ed61-4246-8f76-7168eac3c8cb", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872240, "uuid": "5bd869c4-e479-4cfc-9545-b89faac42b5e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872240, "uuid": "f0689015-1fcd-4b96-9d59-487d875ed14f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "efd95f1d-9196-477e-83cc-d483c8e7f455", "value": "d0dcb59d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d5f870-bc44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621828837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828837, "uuid": "23243502-bf69-4e3a-9cad-0d3aa954c6a6", "comment": "Malware payload (Dridex)", "value": "0bf773d867021360fa29029afbf1352a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828837, "uuid": "21899b52-3d7f-419c-9211-262400c755d5", "comment": "Malware payload (Dridex)", "value": "1d9af7bb18665af576ea47b7f6d99a9a4de016d034e2a5d3afd7ab90f81ca371", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828837, "uuid": "a1090822-56ba-41d9-91a4-02c63db277e7", "comment": "Malware payload (Dridex)", "value": "ec796b1a094ffd6b6d661bfe232d91fbd2acab10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828837, "uuid": "eb9b62cd-b59b-4681-8a19-121d1346de72", "comment": "Malware payload (Dridex)", "value": "556c781091c9721ee940bdc70670393ed81df1455f71d9e75f482c8969abdbf324ae37f9e1fb797f9f6ccb2a6471d76a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828837, "uuid": "64c4e1d9-9816-4789-9003-5a61e27f418c", "value": "42F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828837, "uuid": "83299c5c-c8ed-4034-83c4-5442a709056e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828837, "uuid": "0a97b045-5953-4083-998a-d5b55b3d5cc1", "value": "3072:elpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:elo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621828837, "uuid": "72cfcfa9-a076-456b-b9ff-5705941c1e94", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621828837, "uuid": "c3199c00-2b6d-4fda-a64e-0d805b54646d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828837, "uuid": "2e237dda-3154-495c-89d1-f210a8eaae00", "value": "0bf773d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55846d1-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1621837877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837877, "uuid": "1903dea5-fc09-4d82-b71a-8299fa10b0e3", "comment": "Malware payload (AveMariaRAT)", "value": "1f0eb8505666110e1958af23cb3e8e81", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837877, "uuid": "2421bd17-5e17-464b-8786-c15ed4cf175e", "comment": "Malware payload (AveMariaRAT)", "value": "1db29a824b98071f54fa2da28f92125a38bde16ed5af124fed940ee60d48bed3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837877, "uuid": "1c87ea7c-3e91-4f00-99a1-d235d5e0c61e", "comment": "Malware payload (AveMariaRAT)", "value": "b21742f1c1f3e00757936d994caab80376bc11a0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837877, "uuid": "9a526764-4de2-460c-951e-1923357f964c", "comment": "Malware payload (AveMariaRAT)", "value": "27faae4ecf986c429ad40d462284c733ff54e669ab610e8f0ca511c0663898ae42bab48bbce9265788b7a7dcaac04c77", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837877, "uuid": "75c2c22b-4555-48b8-b1a7-47648b52085c", "value": "9FB39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837877, "uuid": "0767cbec-186a-46ce-9690-1ec95cc635dc", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837877, "uuid": "6af5c470-25ff-4458-aee2-bcc8eb7f65f7", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01+:K1VmhaH8EFvW+0OVE0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837877, "uuid": "361daa7e-f921-4dd9-82f9-114ba150537a", "value": 111904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837877, "uuid": "811dc44e-90c3-465a-ac91-c7c98483e173", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837877, "uuid": "e37d41a9-7ae9-4379-840e-eabd62ba081a", "value": "1f0eb8505666110e1958af23cb3e8e81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fa7f7f-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872367, "uuid": "da368c8d-b3ff-4c29-969e-b49d69566253", "comment": "Malware payload (AgentTesla)", "value": "bdf96159cef8f109d8cf46a718140775", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872367, "uuid": "3b7d4cd2-695d-46a9-bdb0-aae5e6d1a0e2", "comment": "Malware payload (AgentTesla)", "value": "1db4fe5caaef2c6989032955ac7fe51d1b62684c5a3f34f0c58510e100637a28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872367, "uuid": "0d0ced8e-d89d-4392-8240-4f2817dd50a0", "comment": "Malware payload (AgentTesla)", "value": "2d2ffda0df3eef64982b88fecb1062868d386231", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872367, "uuid": "b933230a-629c-41e1-9065-7b1912c88209", "comment": "Malware payload (AgentTesla)", "value": "3c081dbc1a625fae432157b3a921718a3dc961bdb8146d7aab6e810318abcc35af3a90d951d37fc0b6f27376f2c2c916", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872367, "uuid": "862a1f92-7271-40c8-9640-1396b10cf91c", "value": "C3159D2C516EF126C2ADC3794AD4442BE5A0D7373132FE28ECD757A85729E40B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872367, "uuid": "f67fd107-c97a-472e-9651-3f844556df7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872367, "uuid": "967e022f-1735-4d2a-a10b-dd1a22d0095e", "value": "24576:VBC7QuBiY7q7veBkXbaciTDIvuRQFUm7xEtRwI9+Osp:VBC7Z7oeBQbtmRQFtxMw3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872367, "uuid": "85d35c8e-fd1f-420a-b667-5f881982e615", "value": 891904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872367, "uuid": "6eaa0e91-1203-40ec-9313-530f26a4edca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872367, "uuid": "3a7d21d8-86c4-4c01-9cb4-781a9eb5e9c5", "value": "TRANSFER SLIP00020212405_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056a098a-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621878841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878841, "uuid": "a3590eea-0ba7-4040-bd1e-9556c7980e56", "comment": "Malware payload (RaccoonStealer)", "value": "1e4137fd4fbd4e5b1e45af9469bf7756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878841, "uuid": "f558b45f-b905-4c87-a875-280ed46016a5", "comment": "Malware payload (RaccoonStealer)", "value": "1e59e9f70692d3f0518c26948b8fbd6b5433eea644de280a0d3fc98bedb876c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878841, "uuid": "63b15230-44f1-4e8b-8503-737da24a50dc", "comment": "Malware payload (RaccoonStealer)", "value": "3d104203eba79cfb560123020004a6df22453595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878841, "uuid": "c9a94af1-5f4a-4ef4-8232-a3c48775fd62", "comment": "Malware payload (RaccoonStealer)", "value": "625e919c846bbbfa93964a8e2f3c97d1e8f10769ab04a72f63e9652e1d700550dd0f2009195be56877248c2ca5a3065d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878841, "uuid": "848d9819-b8b1-4486-a106-fa7c48fc12bd", "value": "34C4D030A6A1C037F0BB16B055B68278643A7DE16B3440DF22D5EAFE56342E1AD3179F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878841, "uuid": "90d8e773-f9ad-4558-b6ff-00d0bf88b3c6", "value": "804961db55ba5c190e654e6d23768444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878841, "uuid": "c96ed158-ccd9-4f18-8471-fa22e62d427a", "value": "12288:uexd03LaqIgbSnHfxDXNC8JU+pdl/U9TIP1Gt4jNA:x0Ug+HfxDXLVP2kPI4jS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878841, "uuid": "8724b230-9584-4db5-8958-012593924847", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878841, "uuid": "a5338fae-091d-44e9-9f5d-e1b02b4e6fb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878841, "uuid": "18abd67a-5d4b-4ae4-add5-6d923307ae0c", "value": "1e4137fd4fbd4e5b1e45af9469bf7756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0d175e-bc58-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621837484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837484, "uuid": "24164eac-84d9-443f-a84d-14a0f0037a88", "comment": "Malware payload (AsyncRAT)", "value": "ef0c5acdff5bf9fc243aff27c092b91d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837484, "uuid": "559c7aa8-e878-4770-8709-31f8821aaa6f", "comment": "Malware payload (AsyncRAT)", "value": "1e92ffaaee0217be3540c5a8e0b465d639008e15bb1335fc1aab14ef252f4072", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837484, "uuid": "f64d10d6-3adb-4371-b8f9-61ece42d1439", "comment": "Malware payload (AsyncRAT)", "value": "e978dc0e026fcf4568ec16a07fa99b296280221a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837484, "uuid": "d7262ed0-1946-4e50-8f18-321366525acc", "comment": "Malware payload (AsyncRAT)", "value": "bda3af4ec3717548fa8bad3291090c22fa6b2ec3a40a788be67e5aa055920ef833ac9d9d3ab3a3c6850b1659fa4455ce", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837484, "uuid": "8adc18ac-961a-4dcd-ac58-afd16856248d", "value": "C6746B1D4846BE27D2138BF98CE2F477C2ADA789FC9213AC6707B76ED45B12E219051C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837484, "uuid": "c774735a-b792-4016-8040-0eb1d371ffcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837484, "uuid": "70985bcc-6066-454a-b328-f2a760e0be23", "value": "6144:3GtXQhf/888tFyBtB6Ux3pfiDlQfJaBmcFAlQImZB+grQIvc7n8dQSOALR3bAIAF:2d7airORU7tlfHEcV+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837484, "uuid": "962f4e84-c6a7-4169-9531-80c65d871c64", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837484, "uuid": "6aa2c27c-8175-4f4a-b4dd-2edbba81d8ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837484, "uuid": "f7be885e-4ed5-4a7a-8fca-0bdb8e093a49", "value": "ef0c5acdff5bf9fc243aff27c092b91d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5237f431-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1621871238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871238, "uuid": "87e16760-99be-4ed3-8307-979b289c72f2", "comment": "Malware payload (AZORult)", "value": "8429bc212a07d59710256ac4a3ae0cee", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871238, "uuid": "e0caaad6-d662-4a3f-8ae2-466831aba427", "comment": "Malware payload (AZORult)", "value": "1ec60aaced1f41bd75fd22f58cd4f940690c0c2902ceea8f1e5e1f304dbffec2", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871238, "uuid": "b2f73c1c-b6ed-4b24-af32-0b517c9822d1", "comment": "Malware payload (AZORult)", "value": "840f41ff0b2455d48e77de2a0a70501a9c2afb37", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871238, "uuid": "5d889b45-434d-4d5a-a5d7-7b943c7c4516", "comment": "Malware payload (AZORult)", "value": "d98b9d326f31b725a975f296fa50f4ffadfda3aee95e0f1296a799ea7dad7fff017ff45152c51c864b3ac2aa933d57b1", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871238, "uuid": "6ed78a17-8af4-40ae-a29c-bf0710aa1fec", "value": "5B751C4FEA9720334807CEB3BCA5935FC8F114E2869654BE2845BBFA2C767C12D5E152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871238, "uuid": "6c34152e-772e-4129-830f-1247586cf4e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871238, "uuid": "d3dea6f6-946a-4236-93c7-5a21bc0a423e", "value": "768:XQDd7FJVymbAGbe83EU3rtQr1l0pWq5uuAo3KBGPa4Na/1cMB0AwJGJzWxMCTLP1:XQ3JRbAEV3/qrhFuAo3KW0/Q6hf0xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871238, "uuid": "5301a678-7bf3-40a0-9630-56a98b153bec", "value": 1702912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871238, "uuid": "6e4314d9-994c-43a4-b3b6-97e934458337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871238, "uuid": "b28b5a42-83a4-4f66-9c39-9bce588bb6be", "value": "DOCSS...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc81f815-bc4c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832440, "uuid": "74fab439-4ba9-4970-8215-b54e8e1e5574", "comment": "Malware payload (Dridex)", "value": "ec5180e35bef8e5162c82a9f2c911b0c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832440, "uuid": "be29331f-21d5-403f-aa54-47d3dfe3fd84", "comment": "Malware payload (Dridex)", "value": "1f50a1e29c2deaf3f8ee9d7cf068ea9b3e96ca01b663e4b95d9bf8349d852efa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832440, "uuid": "a570cd2b-4753-4289-914a-bb290cefebce", "comment": "Malware payload (Dridex)", "value": "4777499a4664938059296176f8a8e8e98a111d5f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832440, "uuid": "44eeee77-9e7e-4251-8e91-f3c27db59469", "comment": "Malware payload (Dridex)", "value": "e9a14d3fa441121cba818c44bc132bbfbd76e795d5c26a9cc5b3af48fc5ea13184ef985f47ba7a581f4f2b97000c7d3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832440, "uuid": "dd0bb357-6d9b-4c68-86b4-603ffe775139", "value": "A1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832440, "uuid": "c61f5fff-7711-46f0-b17c-4cf8f2ed9ecc", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832440, "uuid": "2c559787-2782-457b-bcb5-d39d631e1c4b", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832440, "uuid": "c6aebf43-c162-41d7-9fb1-d2e4376e7ab6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832440, "uuid": "1e02e81d-7c4d-4bfa-bfa1-5e6247110a0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832440, "uuid": "cf36499c-c9c5-445c-8dfa-09a27e1b4e4d", "value": "ec5180e3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81ced0e-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621821668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821668, "uuid": "a0a84120-7808-4d5f-99ab-2e12415a1614", "comment": "Malware payload (Formbook)", "value": "f268bad6649bd9cf403cac3b3ca0f893", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821668, "uuid": "c0f7a1b3-ba41-4609-b4c9-363999bf52b6", "comment": "Malware payload (Formbook)", "value": "1f608cb60e33615fb8a94a9d240d27cf99bbe344e24a486ed3311623611930a0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821668, "uuid": "4b4e5154-9fb7-47cb-96cd-34025d586d56", "comment": "Malware payload (Formbook)", "value": "110c47231fe4e75b101c00fd78059d10ab9d516a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821668, "uuid": "5b23e110-5b14-46db-abc0-0fc149af5eaf", "comment": "Malware payload (Formbook)", "value": "759e9ba835766c683a3caf04067e88c78710a7302e36bb7bca53bbaf2fd250fe8f3793b41d1fc67afb81c2b7824eff8a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821668, "uuid": "b74e3b4c-9fcb-4da5-89c0-ddda91de42f0", "value": "AD2412352AD1CAAFE11F5AB21CD61B77FBB1FD241325568BA3212F613485293E40728F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821668, "uuid": "91aec61d-3208-44ba-a103-a9bd7ceaca54", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821668, "uuid": "47b355d9-c1c4-4b2f-a246-c1792313e602", "value": "6144:3s6Dcc5YcXCOjHLLlhYy121graV6UtU+Aats8Vt0cF:9Dcc5YzGLLliineV6nVqtdF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821668, "uuid": "b45dafa8-9df5-4673-b434-3580a8e3309c", "value": 215618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821668, "uuid": "5b6c94eb-88d3-4b5f-a4a6-affdbaab716f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821668, "uuid": "f46fb395-79ee-45da-b0dc-91b9fb97b76f", "value": "f268bad6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec17adf-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836068, "uuid": "ecee8656-c501-406d-8b36-87d0ff8a39d4", "comment": "Malware payload (Dridex)", "value": "5e2422ce36dd4165303beedc7c50c6c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836068, "uuid": "7f0180ca-c169-4aef-87a6-c9c3234fd810", "comment": "Malware payload (Dridex)", "value": "1f72ddaec07d8047848f0ee1bff8c5843c911a682762ba9d92037eae3d80443a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836068, "uuid": "4fab22b7-3a32-425f-8829-f62fc7ccb8df", "comment": "Malware payload (Dridex)", "value": "3ca22e48eb764526607194d2e5083e4ee4c1847c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836068, "uuid": "d0a95097-86eb-44c0-8cd7-fb4da7ba5dca", "comment": "Malware payload (Dridex)", "value": "cc882f37762530ad6b48d6754b189958fb828c0090f275757901f04401b0e741eef44b8095e423bdf14ddcc5893ee1a3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836068, "uuid": "3cf5c866-ff8a-4f22-a54b-3094ebecae07", "value": "0E04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029534", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836068, "uuid": "2d641c31-1865-4893-8ff7-515df5ad2fc4", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836068, "uuid": "4a040965-86be-4a81-abc5-09c3b770c927", "value": "3072:uWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:uWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836068, "uuid": "e23c5153-2c58-496b-a1a8-6f05556c4bc9", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836068, "uuid": "b50b16fb-364a-406c-87b4-6707837c4528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836068, "uuid": "d475f68a-b378-4a79-b8ef-ee151c235e11", "value": "5e2422ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef55b645-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821680, "uuid": "1da94349-0649-4381-9184-627c5ec4b0b4", "comment": "Malware payload (Dridex)", "value": "ad16df6522e59fa9483462b2c1622de1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821680, "uuid": "2fc48fa6-05fe-4910-849f-6ec187b97086", "comment": "Malware payload (Dridex)", "value": "20314e62da358506ca58c90bf9589788afd72d69cacd77c1828b3ddb6124ef0d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821680, "uuid": "7798a9e2-856e-4780-9632-52c977f795ac", "comment": "Malware payload (Dridex)", "value": "cc909c4b721b55f777941f3364bc13cff085220d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821680, "uuid": "b9e9960c-90d6-41f0-b27b-c04fab2936c7", "comment": "Malware payload (Dridex)", "value": "f0785d48aef3a7bfa84c008256977dbe9fea86445cade0b0cd89c28837ab5576ea0f29030a14e89d69f57c078dd13927", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821680, "uuid": "56c1f597-1b9e-4cbd-bbde-410eb3a46829", "value": "4CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821680, "uuid": "a1903d84-08f3-4d36-b455-dce2e3cdcb4b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821680, "uuid": "a1de70fe-3cf6-44b9-83c3-2eb846bd92ae", "value": "3072:EmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:NLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821680, "uuid": "55f97111-d696-4d20-aea7-a6d26fca05a0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821680, "uuid": "002b168c-1a32-4003-81a0-9e9ae28d59dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821680, "uuid": "7870305b-3ba2-4e8a-a8a4-6a519417acef", "value": "ad16df65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9d65f9-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836041, "uuid": "8a9c19fe-79f2-447e-8f28-a99fe7581f73", "comment": "Malware payload (Dridex)", "value": "1db9c02419d167d385535f35000afd58", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836041, "uuid": "c2278ed1-6fa5-4b38-952c-da1b62f88efd", "comment": "Malware payload (Dridex)", "value": "204ced844b93d0266dc49bb1a84bbdcaceca44b85193e3675bb0d34b7707cc3e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836041, "uuid": "61907bf1-432b-4ef2-9cb3-89ed41651051", "comment": "Malware payload (Dridex)", "value": "bef439400a4e2baeadf390416275c036f1d36f4f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836041, "uuid": "06cee74a-8f39-47aa-8a66-f87d3ae3ba21", "comment": "Malware payload (Dridex)", "value": "711a746fa2eb1d41f1f61d0e10e2519ff7905d2d9e3525c12d3197c6cd8d12634033fbb078a1c2806b907802e84aeae4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836041, "uuid": "bf627b33-287b-4789-bee9-60a3bc0f811f", "value": "7FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836041, "uuid": "4f9cad4e-2acc-4c41-a210-8c78c66bb60a", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836041, "uuid": "2fc4968d-c236-4813-bdc0-848295325083", "value": "3072:slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836041, "uuid": "494cf8bf-b8a9-4f69-a409-289f36a0ccf6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836041, "uuid": "2a15ac38-9a2c-48d5-aa4c-b87d796bbb26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836041, "uuid": "ef7b0c5f-2751-460e-a891-ac90f6249104", "value": "1db9c024_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77c6ea2-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886468, "uuid": "f333ae50-bf9c-4d47-9399-e1a51ded2359", "comment": "Malware payload (Dridex)", "value": "127aee9f1ecd90687f0092b7b70bdd5a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886468, "uuid": "e1b5c4e4-71c5-4b36-943c-2d48e87cdd8a", "comment": "Malware payload (Dridex)", "value": "2071208f11e0f9021c56b83237d7d534abc770e59aec09fc079fb6b52dcfa826", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886468, "uuid": "d35702d5-36fc-4e80-a130-6d9c5147d7fa", "comment": "Malware payload (Dridex)", "value": "3ed8f201c4f18b2455589b0afd8663074931e716", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886468, "uuid": "40d30422-e8c3-4997-a7ca-36da1523fe4b", "comment": "Malware payload (Dridex)", "value": "48532502e637814a1857a9e5e8e37c00ad5dfef8975f5992b4cc7c8cd551780fa7be65e83cfd037d36d3c673e4d57894", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886468, "uuid": "33740acc-70aa-4e2d-bc9e-4e6d8839e3cd", "value": "4EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886468, "uuid": "f0bfdbb5-ecd6-46a7-9dd7-0f237018fd83", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886468, "uuid": "6a400338-f38b-4cb4-8808-c786fb86f6f7", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886468, "uuid": "36e54a4f-84bc-4b31-95c0-73d4defbd574", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886468, "uuid": "99e36c9b-b621-447c-a49d-b6f198e25c92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886468, "uuid": "790fb7df-ce03-44c7-b664-95a2bd1dee45", "value": "127aee9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025bc7d4-bc78-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850918, "uuid": "4c3c3358-32b7-46e7-8c3f-e03504431327", "comment": "Malware payload (AgentTesla)", "value": "096097aef86ab914dc7a582db93d6b84", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850918, "uuid": "3c183794-3b30-4a4b-9d69-0fdf5fcf23dd", "comment": "Malware payload (AgentTesla)", "value": "2122b12c1f10d2b0dcd824612939b67d7a24a08c9e929eac08ba71430afe4fb0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850918, "uuid": "12102cf4-77fe-4986-99d4-4db74635697c", "comment": "Malware payload (AgentTesla)", "value": "02dceab9a05413aa560167e9c27bf7481310eaba", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850918, "uuid": "2abd6f0c-5c3a-4c3a-b868-62b57804fb77", "comment": "Malware payload (AgentTesla)", "value": "965fc10811e4ba41c2832784c3a5f78aa59dca2228b740a2e161340ea40cdf68b62c32afd8a8a25a53f587a071471ee9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850918, "uuid": "ed46a56b-227c-418c-aa5f-1ea8f64954be", "value": "9AB42348BA2E5876D9C61C01A70E72DA454E2FC02730FD815B21795B58EF9E92CF27F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850918, "uuid": "a4cc930d-2902-46a9-8067-0746e8916484", "value": "12288:33Pv47u8wpmCU2JHEYuMWDMJ0XN1MVRQE/y2t+:HPvmwIa39rJe1MVjyQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850918, "uuid": "ed6c2fc5-b6de-479b-9bdf-200d2f43e651", "value": 523432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850918, "uuid": "3bdc1eca-45f8-4565-ab2a-06f3fde3279a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850918, "uuid": "0c030f14-ca68-414f-bbaf-3347c2aef6dc", "value": "Invitation for potential projects Specification.PDF!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff3d5ca-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621861383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861383, "uuid": "8d6900b4-4294-47b0-aeb3-73b92afcd7f1", "comment": "Malware payload", "value": "595c281246f0fc0ed84f34c5bfa857c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861383, "uuid": "5bc6c503-d1d9-4667-a73f-844815df1879", "comment": "Malware payload", "value": "21423d202df72cbfc2633af358bff81380cd2be531279debcaa665a3dc36b265", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861383, "uuid": "32973954-7eef-423f-af4a-06e2988a29ed", "comment": "Malware payload", "value": "8cfbb7311f71e2575efcf177dd0c4b9d4e6a7dea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861383, "uuid": "417a9f42-d72d-430d-bea6-03c1da95d52e", "comment": "Malware payload", "value": "7806a4affe14372b85df1655348512c0e516e07c13ba05960889e1c9ad0625ad173b6260e0983a9f4a9f29b7966f195c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861383, "uuid": "7f9f4993-b2b8-46d8-af59-afa6e3e6c1b2", "value": "46B423CCAB91983AF79800B7C445A7920CB75AD34D432E1DFB2265D0B7B4D7641E0FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861383, "uuid": "7899ad43-3421-47cc-8b0c-998a95f99ea0", "value": "12288:viiEthsYMlPYnW+MarqTwnA1/FAO0KUzbKlLcpRK:vTwhhTz7edAOMzEobK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861383, "uuid": "808ff45a-3f88-4b38-ba66-aac1db102a2c", "value": 498242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861383, "uuid": "363f3cb9-96d0-4bc6-99e4-392003223706", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861383, "uuid": "79a3037f-51e3-4bbc-b2c0-c8fbfae5979c", "value": "595c2812_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9687ccb5-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621868776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868776, "uuid": "2e69a004-d9c1-43c2-8af7-5ba95768e1fc", "comment": "Malware payload (Quakbot)", "value": "434e0f50038dee1c268e4d7239a32b52", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868776, "uuid": "1d1b96a0-31ce-4809-9929-9a0e0016a774", "comment": "Malware payload (Quakbot)", "value": "215de65edf7cb061ea3711903e0a3757ec7a6c2df73352a710c33cb5b50e5e58", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868776, "uuid": "bafbfa11-a715-4635-b0ab-e502a1d53738", "comment": "Malware payload (Quakbot)", "value": "52ec9818f42220f63b5eeabf91452ac7adcac3d4", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868776, "uuid": "342a7071-abfc-4600-b64a-90ac143e3d16", "comment": "Malware payload (Quakbot)", "value": "d7cb3be06ac09025cb9d688257784c322fb0da83b48dcd7667ebd3756a5e5b53f3dfaf3023a8646ba7df34961387e8d7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868776, "uuid": "b7e48ce2-6756-4289-8b74-42098cc51e17", "value": "780402EDAA91E525E7A408F3C4405B831C771FC747876C6A7B12628477B09F742C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868776, "uuid": "ce4a90c0-9d33-489a-a75a-025353971b01", "value": "3072:SRevjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHzX:6ov8cKSsYodBXC0YnW49MarG19TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868776, "uuid": "7c8cbcf3-9ad6-4d48-969e-6d14964d080f", "value": 187789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868776, "uuid": "788e1edd-1025-4374-9f93-337289366c68", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868776, "uuid": "1a491cd2-0bc6-4bdf-bd2c-1ea7455bfae6", "value": "3112032762405242021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863dd53c-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818068, "uuid": "24972dfb-609a-4092-9236-23b8cf98f8c4", "comment": "Malware payload (Dridex)", "value": "a029c9e0a83b961b7d9748e2e19fae62", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818068, "uuid": "2a62aba7-5746-4bdb-9fc9-e1baa5360591", "comment": "Malware payload (Dridex)", "value": "216d1cffd9d8dad82b407da21decaa3f5871a1abcd6d4298fb5ffde1f7aa49e7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818068, "uuid": "d972bc69-636f-4d10-a40c-3c4ec1290e65", "comment": "Malware payload (Dridex)", "value": "ebf8d586c163e56d41a529492f6900692f810c88", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818068, "uuid": "88a6286a-15e4-452c-b1b4-bb5cf33a09fb", "comment": "Malware payload (Dridex)", "value": "ba209a2c109d4d590f591a9acfeebf1026b5db1f3bb024b9649c978e350468b9640fea5700d85ec6a2ecc08621f9ec32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818068, "uuid": "734903a5-6faa-40d1-a377-03c7d2e72eca", "value": "2BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818068, "uuid": "8fc73e2f-a347-4fb1-9d19-3048ecf4b200", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818068, "uuid": "2f72433a-ccd3-4fb1-9126-0898317581f0", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818068, "uuid": "0d06f7d7-2e0c-40e5-a4e2-ae4557b0eb89", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818068, "uuid": "7770f35d-7b68-4aac-a52c-edb7fb6e116a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818068, "uuid": "5a738bcc-6c9b-46d8-99ae-24fd725da7b5", "value": "a029c9e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3db84c-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872916, "uuid": "71af8770-eebf-4c50-8b20-67a07c48c701", "comment": "Malware payload (AgentTesla)", "value": "14f75f746644c3bd5f366950dee447e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872916, "uuid": "0bb4a470-c3ad-4621-980a-b2868e445deb", "comment": "Malware payload (AgentTesla)", "value": "21ac056b235bd398ebfd0a44c1da33bab203da537c1a3e064b637efe11bbdca5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872916, "uuid": "c7fbeca9-2623-452f-8762-584937ff1702", "comment": "Malware payload (AgentTesla)", "value": "dfa09b1a84a800c66bc74a6f3b66e1f43cc8bf1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872916, "uuid": "16dff40c-fa0d-49fd-b942-ab36a6cd4a97", "comment": "Malware payload (AgentTesla)", "value": "1483843942a8dd0e6b5eb59f96ec7ef635e85a86991d2fa2190e741171ecb8028b223320d7bc8daf9698c67b3eaf04f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872916, "uuid": "43a412b3-c711-4519-a2b0-f71e148bb8bb", "value": "72050249728CDEB7C29D12FCD814D55093F491D37983FB44BF98B8FA6662391BA0218B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872916, "uuid": "beffab21-1836-412c-9b5a-4d34377c6f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872916, "uuid": "70f683a4-82b3-43a3-96b6-6b851ff189c9", "value": "12288:KJXrwL+genQKEik764GkCiRd7kgqOtX6ydzUpIbki2ARULPxdBSQx32g5hTweSDL:AXrNgNifWLCpIbYJbXxGgfwey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872916, "uuid": "cae0a147-284c-4b46-a2be-cc6209bcce33", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872916, "uuid": "4b00dd41-ef59-441f-a17e-0b3ac3d216b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872916, "uuid": "34f38668-0a7f-473f-8660-fe3984aff3ff", "value": "$49,600 Payment Copy Review.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8449200d-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621876047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876047, "uuid": "f3ff5bec-1cc1-4f81-8368-874eb3582ea7", "comment": "Malware payload (Dridex)", "value": "dd07a9eca84254ac8c0ea932d936c411", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876047, "uuid": "e99989cc-c4d7-45df-81dc-15665fdb3547", "comment": "Malware payload (Dridex)", "value": "221e96ba646e67a402e44156d7ed783672ed59063603319b144016c3dba40c54", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876047, "uuid": "2f041ee0-db01-4cb0-a3bd-dfd3df313010", "comment": "Malware payload (Dridex)", "value": "1eaa258fee3ffa6791f3833fcca274352170a82f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876047, "uuid": "f55130a2-f74c-420b-9eb4-4a0cd5920c6e", "comment": "Malware payload (Dridex)", "value": "1ffe6624051cfd7bb90491f13ba9dd2f68455bbc15346d386004ac1c4b8f787f5c26a6531a27d2b709d9fd88458051c0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876047, "uuid": "228c8ab7-0bc4-43d4-ad0f-d318d54943d1", "value": "4CF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876047, "uuid": "08e849e5-c89d-49fa-943a-4b6389b5ab98", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876047, "uuid": "1110d7f3-3c54-44e2-8523-48d7ed22ece6", "value": "3072:LIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876047, "uuid": "780d2f9b-4ff7-48f7-bfa7-a4e91cf0e7f6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876047, "uuid": "c6aa112e-081d-49cd-93b8-cf619e3dc0a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876047, "uuid": "93b52606-ac37-4d98-818f-fdcec2073acc", "value": "dd07a9ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5956f2a-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846951, "uuid": "bb1c8d57-fa47-45fb-8f16-f699c0b1a848", "comment": "Malware payload (Dridex)", "value": "ae5a8f00308651130ce00299299895f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846951, "uuid": "a409be12-9771-4766-b731-20e3e6da68a3", "comment": "Malware payload (Dridex)", "value": "22688707ad0fd81a97e9f6ad0cf28c1c6b4be6c6b9ecf71057767589bd475258", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846951, "uuid": "88281153-b1b3-42a2-8ea6-e890eafcc3d1", "comment": "Malware payload (Dridex)", "value": "fc6a1c8752b909b0930e0627736a1baf6e25eb7b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846951, "uuid": "3b2e2512-e467-4e20-ae0a-77aeacc9b149", "comment": "Malware payload (Dridex)", "value": "3b41956af0fb20c495286f9fbeca1ed7f2f756ca822748b05e5bb689d0ecf720a510c07d178b4a3009ae03505d7cef0b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846951, "uuid": "a89eebd3-5114-4ff6-b7a1-6e25ed9f3ade", "value": "E5F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846951, "uuid": "cc3e0088-1b6f-4dcd-9336-0a025bd5e4a0", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846951, "uuid": "64c20254-ee50-48bc-80eb-85cb8139f651", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846951, "uuid": "55c91329-fd92-41cd-a183-fc44bab83047", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846951, "uuid": "2df24b6c-112c-4e41-94ae-6f8b6fb662bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846951, "uuid": "b3d04dcf-1085-41c4-9f5d-4529c2878ea9", "value": "ae5a8f00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10098c07-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872845, "uuid": "21f91777-dbde-40de-b6d1-79e06c306653", "comment": "Malware payload (Formbook)", "value": "21522731fd1b5239ac51aaf50dfa2f1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872845, "uuid": "326ff547-4fb8-42fd-bae7-b38bcc698378", "comment": "Malware payload (Formbook)", "value": "22b8efc34b36c07e5b13908d58dcabee02fcff2e4c94f31798bcfd090a067f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872845, "uuid": "45afb19e-e357-43a6-b530-730df72ab179", "comment": "Malware payload (Formbook)", "value": "ada449c712656b2d76bdd679056213008ed672ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872845, "uuid": "847202ed-0264-46cc-a7be-13d3b7efad0f", "comment": "Malware payload (Formbook)", "value": "6f0f90bb91031b4f323a89f270d73f48bdf6fee1b93a91e645614ad67990292bc84af733951505d1c371f235d17af52d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872845, "uuid": "4f9531f3-14ee-471a-bb51-441528862486", "value": "28159C2C516EF126C2A9C3BD46D4442BE590D7373032BE29ECD717AC5B19E81BD8227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872845, "uuid": "d2fe5106-bd14-4289-8fde-1dbd9afae272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872845, "uuid": "ab7e50b7-a10c-43eb-b0b6-46fef8654f11", "value": "24576:aBCuJi6e/89s5SLL1xO/8nMxlefQqN/5f50u:aBCuJi6eSs5SLLnO/9eH/5f5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872845, "uuid": "942155e2-4764-41e6-93ec-7bf67597bfa2", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872845, "uuid": "12515776-ad0c-4147-bb3b-c01451a95ab3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872845, "uuid": "ac8d6f19-5316-488f-9774-59a3f121878b", "value": "pictures.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d83273-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621836133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836133, "uuid": "ddff490a-cf6f-4d8b-b4bc-d9af9d497337", "comment": "Malware payload (NanoCore)", "value": "d14499c41a967e2e17d233a551a1dca5", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836133, "uuid": "0135f76a-47d7-4bd9-80ae-5bb7490bb53e", "comment": "Malware payload (NanoCore)", "value": "22c208411b9e101ad60a0ce3abf50033914423c44f46d608213ba1820632c309", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836133, "uuid": "5b8050cb-6131-4ab5-9826-a980c6c6fb80", "comment": "Malware payload (NanoCore)", "value": "8f26e74c10ed17eb3bf6c4c86828022571658a9f", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836133, "uuid": "bb560021-6c0e-4531-9f3a-4a877fae4734", "comment": "Malware payload (NanoCore)", "value": "fbf0bac0597ff0067f3b1ffc4c85718025ab93f27c7a01e1763bbb9200cd0b6938a06ebb1c0f03a36ff15748f6b62c39", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836133, "uuid": "81621031-8369-4ef4-ad04-5a007e38dc77", "value": "EDC423B60D693CFEB90413D3817B2EC4317325CBD55D2ADA070A00B37DA6217923CEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836133, "uuid": "8bcdb59c-ff2b-43ab-980d-a1e00cf7a03c", "value": "12288:TeM6xiXUe6np6CueqeEWPcRvUFQuVRKh2/e0hRpKBA1:TJ6xxe+6wshIQuVRYd0hR8A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836133, "uuid": "3c7894c5-1775-43bd-8729-33558958ee3c", "value": 585374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836133, "uuid": "03d031f4-2990-46bf-bdf7-5c3087c8ee1f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836133, "uuid": "0f67601e-b46d-4fab-a6ee-bc3e06481fcb", "value": "SKMBT_C36017022513491.pdf (32K).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b66b9c-bcaf-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621874628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874628, "uuid": "9fe0165f-8f43-41ce-9a39-d389e2c33551", "comment": "Malware payload (AgentTesla)", "value": "de30fde1bf36a16c36f15610400a2580", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874628, "uuid": "96e05b30-a93a-47a1-8be9-688766c9a1bb", "comment": "Malware payload (AgentTesla)", "value": "238592cf69836b50eae5a3ccaf31a0bf0c67ec895fae2373eeaf23862eb3c57d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874628, "uuid": "b50a3b97-4662-4f62-91b3-efd2a6d4d4f3", "comment": "Malware payload (AgentTesla)", "value": "5256f99d7487824f1a49fed6ed823b9e40360975", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874628, "uuid": "80dc049d-d006-479c-8f0a-ab01973b8fdd", "comment": "Malware payload (AgentTesla)", "value": "c335acfe9b932582f13ed68e35c9842676461cd613c4bd08d03360aeb050d923c8d2eb382eeac1a46f9a0fd675c69a94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874628, "uuid": "f5b6eaf7-756f-45e4-b710-75cbfe3ffcbe", "value": "C9159D2C516EF122C1ACC3795AD4443BE590DB373132BE29ECC7279C5B19E81B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874628, "uuid": "4ede1141-89ff-40ce-938e-5d606836c845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874628, "uuid": "2ad4bc2f-a3f3-4e0c-b981-e42369d59a1f", "value": "24576:dBCaUo9Vp19EWUKXmoVya/kCLtJEpu5YrK8Da4:dBCalVp/JUKWoVRkCL4pv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621874628, "uuid": "663d4faf-4fdb-47f6-92bf-308036f08a22", "value": 877056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621874628, "uuid": "a8ae523a-a473-466b-9e7d-79f9631459ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874628, "uuid": "ca6e5ee1-8fa5-45a4-a63a-849c4a3798cf", "value": "ORDEN DE COMPRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941e7cce-bca4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621870061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870061, "uuid": "b01046d5-c7c0-42f4-abae-da3da74f2de7", "comment": "Malware payload (AgentTesla)", "value": "e31e8a12b6244c6c220535255a89870d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870061, "uuid": "5f3b1be6-5522-4b7a-a1d3-291c999ac9fb", "comment": "Malware payload (AgentTesla)", "value": "23a500b9c73a6687db33f5b02d719be61c158d7870b5728b037ab99c74fb6c01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870061, "uuid": "f47b5b75-53c4-45e8-a52a-5b36a4dd8f04", "comment": "Malware payload (AgentTesla)", "value": "b078507b5dd29d777526dc1b5078d2e3621b9bf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870061, "uuid": "30802003-ae65-4ef5-a6c4-346c196eaf59", "comment": "Malware payload (AgentTesla)", "value": "3f796168acc58cf3de03426d2b83752fa0a18e96fb060da259a51cc4b060325174ecfcc88731c224c86060195c1816d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870061, "uuid": "88243f9d-834b-41b5-972a-0cbb6536e7a8", "value": "AE712A952B7D2893CC7791DDA930F40B02CDF2BA69D665C934AD6EC20B2932B4F93403", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870061, "uuid": "e866b96a-2942-44ec-bfe6-9babf0b11546", "value": "48:uapa3+635IdYk7ARmfb1QhtQs8DdiCIBSjwZtHqBEPdOKwRAdNciJaJ6ag7fdNw2:LhKRk7nDw5vBaUiod0ALciJMvy9fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870061, "uuid": "0331cc17-5fb0-4d6f-8d8e-f5ec880d65ff", "value": 3585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870061, "uuid": "f1332867-f2d8-49c1-93df-5edb0f915db5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870061, "uuid": "dff92c5c-3f25-405c-97a5-ae74a24b85a0", "value": "Payment Advice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fba4ccd-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621882858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882858, "uuid": "d5645e99-cebd-4a03-8edd-e90dd6c10341", "comment": "Malware payload (SnakeKeylogger)", "value": "c26f4d68a40fe70a840c6e95e69f5217", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882858, "uuid": "9453c9e1-0c0d-477c-a68c-6e367cbac89b", "comment": "Malware payload (SnakeKeylogger)", "value": "23bff4532a961b7aa51d420ffb369b93f811ac00809a908b2c6c0c7798db3692", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882858, "uuid": "926c962d-af71-4919-8ad9-a35b1ed26d5d", "comment": "Malware payload (SnakeKeylogger)", "value": "9c4024a1fc193fa8435ddd30acf9a0227db122c5", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882858, "uuid": "2436e0ba-11c9-441f-a778-a6d9a65fe806", "comment": "Malware payload (SnakeKeylogger)", "value": "e20ee11ffb9c0f46666eb878f0abfa9df1808ac59f9f485361bc80cfe83c8253dbb863f9db848f317b0bd9e97a5d1104", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882858, "uuid": "de159a51-2256-42f9-8b24-9a96e5564dc6", "value": "E7053330D5B9917682E4D277C1B7A02E15064BDBF0AFA290A9607D70C4B18D6F2F52FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882858, "uuid": "0d1ee3a0-8120-4f5d-ba53-68512da2616c", "value": "24576:W9lAPXzjniI2lpTRVoFEEZifYX6iNeMH3:WczjiIoVoefbsXH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882858, "uuid": "6a69d3f7-f4e3-4736-a42a-891d47897513", "value": 853956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882858, "uuid": "2a979334-92b0-4bdd-ac57-4d98f028e6f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882858, "uuid": "138b47b6-606b-4add-829b-316ee15db84a", "value": "c26f4d68_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5840498e-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872537, "uuid": "f4eba070-7375-4c8c-8ec3-80d8fc605375", "comment": "Malware payload (AgentTesla)", "value": "f867abce7530d9b5a7079ed9d2458c6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872537, "uuid": "c55574f6-7feb-4ee5-b980-624761cd0076", "comment": "Malware payload (AgentTesla)", "value": "23f7aeeb6935a43885336b7a2969c1be99176c7c6b757fe2d0c62fc712f604f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872537, "uuid": "600fe74b-fd3a-43a7-8823-0988df20c66e", "comment": "Malware payload (AgentTesla)", "value": "4c578d17b3e1057aa347e8e9d7da942dcc4771a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872537, "uuid": "327193f8-f05e-450a-a144-552047d9b0a7", "comment": "Malware payload (AgentTesla)", "value": "24cb403f753b1ecc861162210cdf8353ef1f00d1c62429303237ed8c579e26b121853a2be27acbb39f6d4a3d4d61eff1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872537, "uuid": "9dac18c1-fc92-440c-8735-8d7beaf4ad0f", "value": "5B3538DC5D5AF11AC159D27835C440BFD353EF3320B9AAA69AC3EBD94317E4078812AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872537, "uuid": "cc39b7bd-7c94-480d-8749-50d77cb761d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872537, "uuid": "09e453b8-b0f3-442e-854a-50df9c80da1e", "value": "24576:5BCW8Nk58LIm9pnEzwcOf+hjfU66CfLc:5BCW8Nk5mz9pnEzhOf+1fU6/Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872537, "uuid": "5b3811ee-3fb4-4ab7-833d-633d10e3112e", "value": 1075200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872537, "uuid": "f11fc305-bd2a-46ad-8fe6-3cee091d8998", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872537, "uuid": "8cb5aa84-6f01-4025-8db9-4bedeb3d0930", "value": "Vendor QHSE Questionnaire form 2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171072d5-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871139, "uuid": "e828f1c9-4169-4574-a2c6-cee392df2602", "comment": "Malware payload (AgentTesla)", "value": "a562e7cddf912b5d5afbad2a239549d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871139, "uuid": "a13589df-f0d7-430b-a66e-d4e482433394", "comment": "Malware payload (AgentTesla)", "value": "24142fe6a023146eccb84ed100010fd798ecc8b9f45b4e261563ba3b8596d69f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871139, "uuid": "1862f4d2-d423-4e72-9f79-ff90e374f221", "comment": "Malware payload (AgentTesla)", "value": "876757d06214a8b55dbdd63d3feba3c14c2d94e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871139, "uuid": "b5e7b8b5-ebc9-4cf6-a29f-f2a6516ee733", "comment": "Malware payload (AgentTesla)", "value": "34b5d435db1939efd20fa3ea02eb142e78028c5b5f06f5c5aea0d0693a943045dcbb7c02e8c9eb5d252707e277519ffe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871139, "uuid": "aae5a833-6e60-44bf-9632-9917adc218c7", "value": "EA159D2C616EF126C1A8C37D46C4842BE590D7377132FE29ECD3179D5B29E81B89227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871139, "uuid": "4b26c38e-07f6-476c-84c0-974a360a6d3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871139, "uuid": "693df6fe-1594-4acf-8aea-e2f500fe3852", "value": "24576:cBCXXya4Ds08xEoo6h9MLoTLV5U1AKUpa:cBCXXyarSoo6LYo1KAKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871139, "uuid": "a48d240c-2bb3-4697-b6b7-dc8296c47f28", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871139, "uuid": "8ac063ba-7502-4808-b6c0-338de8140039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871139, "uuid": "1db3bf67-8da6-47f2-aed3-11cfe43baca3", "value": "nh9FWiRyErMAMKO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1c1787-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621850772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850772, "uuid": "408c9123-53dd-4629-a84e-fc78fffa4f47", "comment": "Malware payload (Formbook)", "value": "bd53fbfd9142ea4fa418e8b94718c678", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850772, "uuid": "e367fc7c-430d-4ed3-86d4-9fd082f591ae", "comment": "Malware payload (Formbook)", "value": "24b9f122349006afe996eb49534f12789789e56b5ebea1c4cae476ee13c0ce25", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850772, "uuid": "d4dc0f72-b2c6-42b6-abf6-8efc1eed3221", "comment": "Malware payload (Formbook)", "value": "89ba5ed5265e6b25b4ebc9430e9d74ce6251c12d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850772, "uuid": "11feea9d-b94d-4240-9961-5c268e734257", "comment": "Malware payload (Formbook)", "value": "43eee509a214dc2ac164599f93f2d25cddf9063ab18db6b0967c5fd75fe55216cb917007dcf83fefe25c91167de0a788", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850772, "uuid": "9e549a08-d4f9-4bd8-b577-42fe30e63865", "value": "E9A423DC4F156DD44FEBB20A593E67EAC1C0FA693C8A6C6B417909D3CB8033E1476859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850772, "uuid": "a9e59a5a-8480-4c25-b5aa-860be97ff8e6", "value": "6144:W9bASkVCKQo3gHegyVLb2Q/O36Y8VlNZ1XxLJX9go1blxt6/kXAhdnRsutnETqLf:W9bvCd52QGKY87JfCs1pQBjLxB+y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850772, "uuid": "005c1398-4d6b-41f8-b0fb-7c5e2781ae8c", "value": 488710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850772, "uuid": "66f792b2-78c9-48d7-8310-c8ca1d22a78e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850772, "uuid": "e10555f9-c6b5-4100-83c1-25cda576f684", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfa0e21-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854052, "uuid": "64c00194-358f-4100-8575-3cd18f166922", "comment": "Malware payload (Dridex)", "value": "e80e9e73e7482c936b0caf5c4b85ed8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854052, "uuid": "64e426aa-f23e-4bc4-8a61-3dfadf1d2d56", "comment": "Malware payload (Dridex)", "value": "24ec383ae244d75f124e872861ac4df731a2893e33db1b7a663e281d391e3b7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854052, "uuid": "69d3cb52-1279-4a54-9b63-60950bee40b3", "comment": "Malware payload (Dridex)", "value": "2be835c56d13529c7ff3d9bbf257c1aecc0d2d03", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854052, "uuid": "3ea9414e-8543-42a1-8b7b-bdc62791e4f2", "comment": "Malware payload (Dridex)", "value": "44fd64d8bb41d30a058994e20a418e1d53aa56caaf1e921ef0b2257d1eb8afaaef1b0ab429db070cee01f7924597f350", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854052, "uuid": "94972291-0851-4386-89fd-444064070816", "value": "6DF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854052, "uuid": "69bf48bf-83c2-4e01-9938-9501ae5e93d1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854052, "uuid": "4576f58b-39e2-4948-9880-07e940cf1afc", "value": "3072:HIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:oc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854052, "uuid": "a8706d13-18cb-4c46-98a9-4e7306bead2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854052, "uuid": "33c70e70-ecc3-4893-8bd9-6574e4965062", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854052, "uuid": "86683870-3b33-45bf-927f-74c5e09163a0", "value": "e80e9e73_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdd318c-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857672, "uuid": "2f3f58c5-030a-43d1-a376-48457e7829e0", "comment": "Malware payload (Dridex)", "value": "2988efac58546685a99173b880718349", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857672, "uuid": "f98adf5b-5f6b-4176-95cb-bc6f8388e28f", "comment": "Malware payload (Dridex)", "value": "252ea2a4f40c7478ecfbf49e9cb3f5d9fcee8281de60d07d268db00ee0a17a84", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857672, "uuid": "0cb508e5-467e-47d5-9152-5092519e2c05", "comment": "Malware payload (Dridex)", "value": "1a4d6a45a9c30e32432c0c8ca0e995794e2eeb7f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857672, "uuid": "971e6c5a-bad5-4f09-af57-fcf5e9bc7116", "comment": "Malware payload (Dridex)", "value": "0cc42bb4499a5186fcdd6da21b1ddc35aa4e0a52223b424ebf0b9d34de00edbd189452d1f045a08a206f3b5e1dc4c69b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857672, "uuid": "76deda14-03f4-46b4-8ceb-44b1903e8ebf", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857672, "uuid": "ae48c196-a2f3-4203-8491-36dc995cfe49", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857672, "uuid": "3ae38426-8ef7-4969-a2ea-3afc01c7bfe3", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857672, "uuid": "76225137-da42-4569-bba7-9998e38efda9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857672, "uuid": "ef78cd29-0664-47a9-b576-2c4b7406075c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857672, "uuid": "3e381e49-37a4-43f6-85de-30403ced55d8", "value": "2988efac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79d11ac-bcb8-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621878791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878791, "uuid": "03b55dbe-2aa9-45c5-a7ea-3b351fcc3a48", "comment": "Malware payload (AgentTesla)", "value": "f9783cc36e150eff4c6d6a5933c59373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878791, "uuid": "07bad1b9-0d3b-4422-a45c-f89b6992a7ef", "comment": "Malware payload (AgentTesla)", "value": "253a4a9b210e4e8e2f466bbbae34f5a535a3d3a6340432e18ff502d33d40ab2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878791, "uuid": "35fd72c5-9909-4acb-afbd-79d4786fd0c8", "comment": "Malware payload (AgentTesla)", "value": "ecfc136ec1e4a173dd6be6070e502afa55bf439f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878791, "uuid": "c5b34477-fb5d-4d9e-a7ce-9cee53727ac5", "comment": "Malware payload (AgentTesla)", "value": "7d2f15622835cdd2e0b7b06dc31e2e805ba9d4feb3ddd23299f1bf64eaf7950114184ba71a60bf41c3d27065841b9f0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878791, "uuid": "0dca7b4a-9cdd-40f1-969e-fd4cc9339972", "value": "6625271E2E99E519E0E8C63D05F81027FF12CB73203AAED698C337AD1695D41F96162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878791, "uuid": "cde160b6-1d6f-483e-accf-9264546cd3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878791, "uuid": "91ba1343-4ad8-4b99-8acd-f706eeb72737", "value": "12288:2ktBoV+Xp3sltePXPBNkSVOl6nRLvuKSfLITKPUkT68ENIs0rmlzGJ6+G7WuilNE:2ktTXpcltywYvpYeKPUI66SlzKY6QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878791, "uuid": "04fbd7e1-9f2e-49ae-9a3e-3a96d95b633f", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878791, "uuid": "ff4457ad-624d-496a-949f-87f03e52a3ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878791, "uuid": "6a6b206a-b570-41a6-8ac0-1012b9f06655", "value": "f9783cc36e150eff4c6d6a5933c59373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d315b9-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872486, "uuid": "5570083a-6f6c-4bec-8673-241a3717b057", "comment": "Malware payload (AgentTesla)", "value": "4a58f847b02d8f08e96caed06b5b9c1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872486, "uuid": "58d54fde-c96e-4601-bd86-7aea987b93d2", "comment": "Malware payload (AgentTesla)", "value": "25c67936fcadb77560ec2a12b8417f80bfbaeef3552b102aa706f4aaf97a9fd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872486, "uuid": "db36331a-2d19-4481-9657-b7c65ce50bca", "comment": "Malware payload (AgentTesla)", "value": "ea73f19702a109c1d9f6a0e06631a65163f85f4e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872486, "uuid": "2115adea-7dc8-4f3a-a2bf-d88aa8b6095d", "comment": "Malware payload (AgentTesla)", "value": "0be90212c2bf7969a9bcf1436c258f50274e71155f2ecf008e784f2018f018bb7bac1db4e13649e472423fa66eaafc96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872486, "uuid": "d581f0df-df8f-484d-bf99-ec9ca7706206", "value": "1615262C116AE132C1E9C27946D4402BE791D73F6031AE29E8F7DF58763BE40798D26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872486, "uuid": "818bd138-3716-4ffd-93dd-5215bc6b4d54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872486, "uuid": "8d8574ae-1286-4310-a4c1-31fe79b8d96d", "value": "24576:CBCce3VeNyiaHQ+olTexxaHenQEBngFp64rhLE:CBCcpyiawTMbjnQEBop6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872486, "uuid": "3d2185aa-a889-4ae8-a4a7-ea7ec3017429", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872486, "uuid": "9da3433e-d7f6-45e3-8d87-7a281a349ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872486, "uuid": "6ce18d9d-8e18-4394-93be-fd82125275f4", "value": "HlSU4wxbukkT8gY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4b155c-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1621850562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850562, "uuid": "4a8fff30-a81e-4c1f-915c-0fb12b996a52", "comment": "Malware payload (GuLoader)", "value": "b20e3f39013ec433965ff06dc9f74940", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850562, "uuid": "0d4c82de-1876-4b4f-baf2-8712d2f2ad92", "comment": "Malware payload (GuLoader)", "value": "26209a2258e61ef810975bfcff8e49a30e38cbd4901b2cc14f2a163f360e99ee", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850562, "uuid": "bc3cb630-0867-4cf0-8fb7-e1d379baae3f", "comment": "Malware payload (GuLoader)", "value": "4677c63e642232a8f50832502e45d0b22ac720f5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850562, "uuid": "8e86c437-513d-4335-940f-7ce168729499", "comment": "Malware payload (GuLoader)", "value": "53193a10a64925647f6a1d041e854f73de754456605dbc19234ae1b3bcf62cfaeedbc6daf7621788877d046e7d0eeff1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850562, "uuid": "64cd0e4a-8d57-4d13-bdb1-a639f210a25e", "value": "A7932851A244FF71C99EC3F48212887C5092BD3C2FA8999BD3C1052D36EB5E697367A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850562, "uuid": "021728a3-1cc9-411c-a552-9f7a4292df54", "value": "c0aa42a4533845b7eba74fce6ed7746f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850562, "uuid": "8fdc370e-aac4-40e9-8e3d-aa3bfbc6bcdb", "value": "1536:AzSq5lqsTJRGNtdu1iiGkruScExowc4Gku69clC0:IiWRYKiiGp969x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850562, "uuid": "f3c2fa6c-fe00-4564-bb44-d5347b1c8d6e", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850562, "uuid": "c2548560-a384-48ab-a181-43be577370fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850562, "uuid": "9e954097-98c4-46e2-8768-2a226688c3f5", "value": "b20e3f39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c216cf5-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872597, "uuid": "5705b8f1-89af-4986-958b-60084c49c11e", "comment": "Malware payload (AgentTesla)", "value": "072755be514851cd03d970b39d15c0b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872597, "uuid": "cc989fea-0555-4ed3-badd-82ceb9e7791d", "comment": "Malware payload (AgentTesla)", "value": "267f9957119cf983e4a09aaccdbd2fe7b91305810ad22dd0d9dec94b0278bfea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872597, "uuid": "b07f421e-77f8-4029-8eb0-aaf5cd0eced6", "comment": "Malware payload (AgentTesla)", "value": "d919554b8c18a5f7be651b5e8c0c0a47a5bb9e3f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872597, "uuid": "29a4a18c-c6ef-42d9-ae16-e0781eaa80d3", "comment": "Malware payload (AgentTesla)", "value": "19575cb918dfc20ef52cd2a3b5e870d3003a4debbf3ec8c809bbf3691f14a780ff297b2038501124bc54a774c347caef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872597, "uuid": "a9ea0b60-7b42-4b48-ba1d-4c3edcd9f02e", "value": "41059D2C516EF226C1ACC27D46D8442BE590D7373132FE29ECD717AC5B19E80B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872597, "uuid": "29db3f62-be9d-45c5-8136-a701df91a86f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872597, "uuid": "33e2756b-4562-4aaf-88ca-db09047cc721", "value": "24576:KBCjoeLcv7tx0MA+UCtLNjvh5oO7a0dLlA09ps:KBCjBL3MAMPDHRlAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872597, "uuid": "4827fb8e-7667-4789-b3df-6e836178f723", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872597, "uuid": "7fccd261-fe12-4364-a60e-e89d3540ca8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872597, "uuid": "786b3497-0663-4a55-a277-5ac97d09d522", "value": "TldN64uqpMuBU2x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3288b0ac-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890083, "uuid": "ba4f7917-ec28-4d02-a299-b97932be33f9", "comment": "Malware payload", "value": "381a21afbf333f832f9467b119eb3925", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890083, "uuid": "e958c021-7973-4728-869b-64feb0804850", "comment": "Malware payload", "value": "26c9712bf07ce2cc7c66e5cdeeb5592fd054e3fbd1afa4110fb89abf793fa14d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890083, "uuid": "fbf57842-4e2c-4924-8a66-59a1c213d95b", "comment": "Malware payload", "value": "a4c09eac1cb2b8a192b61a45c95adf2a819019f8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890083, "uuid": "1428f3b3-b9ce-494f-85b2-4aaf5fea2549", "comment": "Malware payload", "value": "8b7c8c7c4aa392b42e9a91de048e302ca81d9f8ba2d771ddddbf39cd9cd228c0d2e2c81010a64ee9a2d3dfdca12d07ed", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890083, "uuid": "6de7dc72-daac-4df4-a379-92e9d64a6d78", "value": "7BF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890083, "uuid": "abfe70e6-fb6b-4946-8978-fea9a336c3b3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890083, "uuid": "2226ce4c-1dad-43d1-9e34-182aa29aa5d3", "value": "3072:olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890083, "uuid": "8af41dab-5ae9-4588-a16f-a2ede2fe52cd", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890083, "uuid": "e856c5ac-1b65-4f0c-a4be-d33653483482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890083, "uuid": "160b4c5e-8886-48f6-a1ec-8d6cd45affe4", "value": "381a21af_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4692754c-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838148, "uuid": "08120510-8cab-44f2-8850-73d24df50657", "comment": "Malware payload (AgentTesla)", "value": "3893d76a1ab81f9622bf485b13251a1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838148, "uuid": "b7222c4b-df42-4afa-804a-53ebf930a7af", "comment": "Malware payload (AgentTesla)", "value": "2707f91debc129ae651dadc56eacde0d59c42f191fe1e48f00529d6a80335049", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838148, "uuid": "269ccf3b-1225-495b-bdf2-09589a9b6da3", "comment": "Malware payload (AgentTesla)", "value": "8feae47343eaa442c9cce224caeb3f02fa49ef96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838148, "uuid": "fc7a2b56-a793-45a7-8c57-f4e8d88c2962", "comment": "Malware payload (AgentTesla)", "value": "f70d315c1d44e431db22f789db7664e7c8512571d063dba5b52aa7ceff47e4bc38885059f3b29028c84e8b3b68647c7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838148, "uuid": "d9c77dfe-cac1-412d-9eff-989a9aa56cb8", "value": "B691D778023D0C92DE4388F2DEB6FE3912E6F15581CB9AC2735EEEB90F673245605642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838148, "uuid": "4b4ea314-df6c-4295-b607-0924166417e7", "value": "96:Y0rUzhx/fOBg7n4xaMGIwoomgjjMf9/xoFBu+4VY:YBzeBgiaMGIJfsFBu+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838148, "uuid": "139a4d8b-c2f7-4d00-8a96-4d59f8aee5d1", "value": 4584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838148, "uuid": "4a9194cb-333c-4493-8513-1ace9a577e9b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838148, "uuid": "d6f20a9d-9095-4080-a723-49e4b41da0fe", "value": "RFQ AN21043- Black Steel Pipes.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54456ba2-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868665, "uuid": "e2bdf7cd-9f02-4f82-99fa-7999dee080a9", "comment": "Malware payload (Dridex)", "value": "bfe7cb154a974a4984abb35223a0830d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868665, "uuid": "22614140-255f-43b7-874d-566550adbfa0", "comment": "Malware payload (Dridex)", "value": "2728a6a67a9c46bf4ea0cfbe13c7410e03b0f2dd212bf72c61c6e6edbcff2f9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868665, "uuid": "7084f037-7c01-4b2b-bdb6-1e7fa4c3480e", "comment": "Malware payload (Dridex)", "value": "d034bca4693c9d3ad45ff4baaa1a0674d1867ff5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868665, "uuid": "7a24d9df-9088-4444-a44f-4a734019bfc9", "comment": "Malware payload (Dridex)", "value": "594bc2fca265e5614143746bb2d53cb9c6a46b76aac72a16f3a12a65fc4fef52cef60228993f380fc100a17858ec6692", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868665, "uuid": "e6d3ca14-1d53-4e2d-b869-98fe8a9f7792", "value": "5E04B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868665, "uuid": "d0f8aebf-4303-4666-aacd-94bfbf0cff5e", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868665, "uuid": "66a4fc3a-8f23-4141-a314-72fdcb413a2e", "value": "3072:4WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:4WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868665, "uuid": "6eb9403b-4a1d-47ce-994b-379d8ac6a7dc", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868665, "uuid": "114077f8-ef47-430f-991e-1c0084a8c065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868665, "uuid": "67fe8da1-22fd-400b-8f4a-1d4097e1f7d7", "value": "bfe7cb15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2ec08f-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893648, "uuid": "c0ee934e-7799-4969-a49f-1ffa00be4b7c", "comment": "Malware payload", "value": "bb497e6ef671053dfce6cf8070462c18", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893648, "uuid": "55347adc-52cb-430c-9faf-6f1c42d6d819", "comment": "Malware payload", "value": "27e187ea7356f7560d82fac0555c7cd55ebaf6016c995366f69b107cab4a1909", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893648, "uuid": "b73bd480-bd13-4031-9d88-a35504590c88", "comment": "Malware payload", "value": "cdcf4b1b31322c6c902a5e0d7f59f0726ca760c3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893648, "uuid": "b99b70cb-1697-429e-a2e7-3c2a583ec40c", "comment": "Malware payload", "value": "9c5e59809ca06e122ae97769f406b0252fd793782be4c6e92adc24604467617517ced1afd4b9610d2332d29aa227ad24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893648, "uuid": "bcf2bdfb-3972-4a4a-b52f-816cd761be8b", "value": "CBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893648, "uuid": "9f56bab8-f299-4927-9da4-83b681f9dc36", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893648, "uuid": "74bebf40-7779-4ace-a9ec-ed588d31226c", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893648, "uuid": "a0d51d43-2e5c-48a5-b598-9d0cb68c6b5d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893648, "uuid": "2e087bad-d9fe-4564-b81c-e75289797e98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893648, "uuid": "74e8e71b-e916-410b-80aa-cf1deb4954e8", "value": "bb497e6e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5c9eb4-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890100, "uuid": "9c4fed81-dd81-4f50-82c7-e0dcdff1b2dc", "comment": "Malware payload", "value": "df760661b80dd30ce6e363cfab70388b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890100, "uuid": "cf1ebdef-800d-49ac-87a4-2c75bf952761", "comment": "Malware payload", "value": "280f9a86e84594ce9018aa15ce5d3a862744a141328c0bf26dc9614e3c9e868c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890100, "uuid": "2f17c516-c779-4b56-ab9c-abd726a3aff9", "comment": "Malware payload", "value": "056d00cc841925f039558866856a0e27f2033fa9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890100, "uuid": "c02c85f3-0740-4087-b9f0-156cafbbf4e2", "comment": "Malware payload", "value": "41563df55307c1a436c6cfc932440f24c2b97c991b69f6c1488be09ee9bc4d3aefef2d7c93c0ec09793ea6084964e2bf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890100, "uuid": "5421a52c-1e07-48e7-84a9-2342437a1e6d", "value": "C204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890100, "uuid": "a836e782-9313-4591-8c5a-44083bce3135", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890100, "uuid": "1fd4b2b4-9b18-4f20-a92f-75da57435149", "value": "3072:gWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:gWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890100, "uuid": "adb5257c-49ee-4883-985e-a3dae8d2f197", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890100, "uuid": "b6d6f8b3-e162-426e-885d-ba1462fa9f59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890100, "uuid": "66f72e23-1f2d-44cc-acfb-35046abc7f88", "value": "df760661_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091bedc3-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839763, "uuid": "64f68959-6013-4963-b429-a4b750639a52", "comment": "Malware payload (Dridex)", "value": "e6456306c35b2f88a3568bdc3d786728", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839763, "uuid": "437e8f2f-4ac9-4928-a99f-84e1577d6828", "comment": "Malware payload (Dridex)", "value": "28219eb9e7921ae1047a77490a0c16e4f999ccf690cfbfd4e629e39c8e2a7cbc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839763, "uuid": "a59ef396-8eb9-407d-844e-34ecb97a67ef", "comment": "Malware payload (Dridex)", "value": "15cd22b13632f49187bbe81646d622a76ebfe282", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839763, "uuid": "6e2b49e4-4b25-452b-a74a-6bf35c7c4cb8", "comment": "Malware payload (Dridex)", "value": "5831ef992509d66059b0aa920b6b6fe523fd9791315c0d7b1a6e3a5e6fc4b6f29c91a01ed693a0ff15a6e2c857539b9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839763, "uuid": "f1f4a744-4e74-43b3-a206-46a0ae287c3b", "value": "82F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839763, "uuid": "d4610cd3-9a3d-42c6-827b-759cf84881da", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839763, "uuid": "22beefdf-8920-4665-a0f2-c09c8f09cb9c", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839763, "uuid": "444f0390-87db-4661-a78b-94e7ce2c45c0", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839763, "uuid": "70d1c79a-d3a1-4ac9-99fc-55a88c10128d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839763, "uuid": "a162dd09-87cf-4151-b248-92ed408eb05a", "value": "e6456306_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0209a52f-bc31-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1621820423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820423, "uuid": "17dc6a87-c20e-4ac2-9a99-c3bf51075aaa", "comment": "Malware payload (CryptBot)", "value": "14745ffebc8937d0895c4e90e1f3caac", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820423, "uuid": "730278ac-86ef-4fe4-9c49-2f869a94aee4", "comment": "Malware payload (CryptBot)", "value": "28620b494558edf4a59fcf787b68ff2cda2f66c8e77a14a5e7045216e074df30", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820423, "uuid": "6b5b8c88-b5bc-4649-b931-7e0ad059752f", "comment": "Malware payload (CryptBot)", "value": "07a71e9e884c5d71be77d773c5fc41159b37eb28", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820423, "uuid": "caf0045c-9149-4504-9421-c15092e38232", "comment": "Malware payload (CryptBot)", "value": "a06facbaeb25cb7fe3a7b1824e9d118c44249ac13a17fec0ad39b857960ba50ccb1b3f225cf4df962c8526692135415f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820423, "uuid": "740f4378-b82c-4a00-a6e9-89854c4fba73", "value": "D9F4E03066A1C035E4BF21B489B6827C67397D61AB3480FF62D636EA12F46E49C7075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820423, "uuid": "21bca3ea-081a-409a-9445-ff92ab754ccd", "value": "48d2401545bc23ddf9125d8d09f6c7f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820423, "uuid": "bd204b7d-fde7-41b5-8110-8b1d52fcb1f6", "value": "12288:qj4Ie30uLQzF52M4ZlD1yMPBuaD2fyVDmjbanjvtqDrcxKFy421eIcuVXsL:seYzuM4Z1JEjbS1f4f3uVXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621820423, "uuid": "e185612d-768e-4823-981a-0856ce93d7b1", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621820423, "uuid": "56a7bb9d-404e-4ea0-af1f-b6834c278735", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820423, "uuid": "74640811-aa27-48db-b12e-9d87e40d20f4", "value": "28620b494558edf4a59fcf787b68ff2cda2f66c8e77a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c4df92-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832516, "uuid": "4f51044b-72f4-4e89-ab37-9c45ff36244c", "comment": "Malware payload (Dridex)", "value": "ea9276f00f94dae12023897195a2f6ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832516, "uuid": "f486b82a-6571-474c-96e5-57fdf0af0a01", "comment": "Malware payload (Dridex)", "value": "288673ef4973cae5524eb2c1cb85c99e5696f4f867a9e4a5ef758a3d4599262b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832516, "uuid": "5e9bfbb3-8c5c-4028-997a-c5c62798674c", "comment": "Malware payload (Dridex)", "value": "b03ab1d0c9fbb7277d174d82e003bdb04212fe15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832516, "uuid": "215fe4ee-3708-45fd-be7a-0c342a69d388", "comment": "Malware payload (Dridex)", "value": "8264581af69f9af24d6982559c2d46d6b6d1ad9a8500e2f9b8467f1d0d44aac90bc704af80d2245e25015a14777fc497", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832516, "uuid": "50f7c7ae-0890-4ff9-9004-1be4724d92d2", "value": "C0F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832516, "uuid": "b7a8a59e-60c8-41d2-b98c-33f98eac02fb", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832516, "uuid": "60cdcce3-1e84-4551-99f8-4b8607b2cc95", "value": "3072:xA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:x3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832516, "uuid": "419c29f7-df1a-4bcf-bda1-c7d3b84a66e5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832516, "uuid": "e9560cd5-42ec-4f27-b9e9-e2fe50fe7547", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832516, "uuid": "9a95190d-74b3-4038-b07d-f59d03046449", "value": "ea9276f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa80ffb-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621882876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882876, "uuid": "33f48650-87dd-499a-8d3f-635ab2a208d1", "comment": "Malware payload (TrickBot)", "value": "719c497138b21bed7779bc84d9ea2b72", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882876, "uuid": "c34d44a1-cb99-4c05-939e-c09f5fa12dbe", "comment": "Malware payload (TrickBot)", "value": "2a032cf1bddbd0e4119e84cb31edf89f58325a6237aa92ff763d930778b725a4", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882876, "uuid": "f3b22c41-75cd-4a30-b603-e3b15bed527a", "comment": "Malware payload (TrickBot)", "value": "af9e3a7957fadcd6347c640201a3835be94b935b", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882876, "uuid": "87abe59e-b4d1-46d2-b168-d1bf482781c0", "comment": "Malware payload (TrickBot)", "value": "cc6e5404fa092c5cedc3284b41e723c9819d817c5a94bd751bfd914351c07f8814919d2c15672bb36fac88c167748323", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882876, "uuid": "77658411-4616-4939-83bd-c0d5e0b11be3", "value": "CF0402EDAA91E525E7A408F3C4405B831C771FC747876C6A7B12628477B09F742C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882876, "uuid": "c61ace79-b2e5-4732-8359-35c82d7b3f6b", "value": "3072:iRevjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHzX:Kov8cKSsYodBXC0YnW49MarG19TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882876, "uuid": "2c335e72-53d1-4dbe-b214-5c610cbaf5dc", "value": 187789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882876, "uuid": "077de5de-5c91-466c-bbbc-450a5606fefd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882876, "uuid": "59f54acf-4f51-4969-9cb7-162dddf62fbe", "value": "719c4971_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae9da37-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621867441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867441, "uuid": "b1b1dd7b-b511-4557-8fd2-201df0b3105f", "comment": "Malware payload (SnakeKeylogger)", "value": "6ea34a19ff521aff47416f8ab4311963", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867441, "uuid": "b1ff5145-7e1b-4159-92ef-58097f278b2b", "comment": "Malware payload (SnakeKeylogger)", "value": "2a14b1082d6e0b2fd03325cd2f91b2704b05bfeda55618526301012a08221fb8", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867441, "uuid": "29f516fe-e518-4ec0-948c-56dc71c81801", "comment": "Malware payload (SnakeKeylogger)", "value": "e173906c673af1b214f1d7be528f0f7beaadec47", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867441, "uuid": "35cef444-a74f-47df-83c8-50c1e146bf62", "comment": "Malware payload (SnakeKeylogger)", "value": "57f0f1aad17f703efe2c79f0b3668d72da42b6d1b8697ab23dbcc7a6e63744040f42eb760daac6dedce990446cc2aff8", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867441, "uuid": "6ac4128e-419e-4d81-a2d2-55706d13468e", "value": "77F42396F5DB176796F343B08F2AA3B500B9E09CB04AF837F3834C70D6AEA147944695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867441, "uuid": "9c9e45b3-dfe0-40dc-b5dc-536049abb974", "value": "12288:WEW4a1QAQjPqHQ9BDunqOiRneFt1pWv0rdAmrzb7m4TWLee:jXAQjPcQeqj9eFt1W02Sv7m4Kye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867441, "uuid": "46f751cf-776f-47e1-85a0-edc7523581e0", "value": 743721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867441, "uuid": "06340f9a-7704-415f-8ed2-74482974cd81", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867441, "uuid": "3bd60d41-3bfc-4ceb-be9b-a2e2c0fea2a5", "value": "BANK DETAILS ...gz...pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7244eeb8-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871292, "uuid": "6882e4e4-5569-4f7e-9833-3894fa07a215", "comment": "Malware payload (AgentTesla)", "value": "47ca1c124f94b26b83cdde7b5cddc362", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871292, "uuid": "0c1f90d1-7a32-47c4-9221-4c032a90169b", "comment": "Malware payload (AgentTesla)", "value": "2a31ce352dedfe83426a33aea06b929ca39d4563434113c0ac4e2d7c1a6eaa0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871292, "uuid": "b88d6cee-7fe3-46fa-9fe4-7c42847b3f75", "comment": "Malware payload (AgentTesla)", "value": "aa89dd38cfdc678ac06f5c489bb7a67cacf392ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871292, "uuid": "53a53801-37e6-4592-be21-f0f43cbf00f3", "comment": "Malware payload (AgentTesla)", "value": "5ce894ce1b70706269070c0f911856e97ab1347ee1c5c34f80457bd12dbcd0ca38baa430677a5fcd30819c6176896ab8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871292, "uuid": "b3569ecf-ccb4-4e31-afe6-70b51bab8a92", "value": "6925161E2E99E159E0D8C63D06F85027FF42CFB3203A6ED698D7776D06A4D02B85252F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871292, "uuid": "44322a73-6ce6-433f-a6c7-58788959be8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871292, "uuid": "9a2a95e5-4f61-4826-8437-c2e9eb31999b", "value": "12288:NJqyLO4OQ9be5e4Fk/Yuo5sYMA980HsRD3zFATgZqD/i4MQ9bay1:NrOmew/g5p8MgpAV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871292, "uuid": "cd0bde61-328f-4683-a463-de218b07ae40", "value": 1025024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871292, "uuid": "25ed1042-cc89-49be-8d98-7efe8a0d28de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871292, "uuid": "3cc3a785-b963-4090-8edd-a0099bab9d49", "value": "yFtb50HV0L2TX35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8464adc-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621875732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875732, "uuid": "1eb3c04c-7b21-4c74-a6a9-3b16ea1804d5", "comment": "Malware payload", "value": "9f16391e114e3737c277879d8c969438", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875732, "uuid": "4344a7ce-323d-40e9-96f8-ddde49226f03", "comment": "Malware payload", "value": "2a678765b7c8437e56beb0f1266b3a76772f4e573aef4178e33d62ab28ff85c1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875732, "uuid": "49bd6a5d-057c-4a69-bda1-f68f9acd6e38", "comment": "Malware payload", "value": "88e7135c9c775c54538e2de87d2b010659150502", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875732, "uuid": "b937f3d5-2577-4b20-b8ce-973476213890", "comment": "Malware payload", "value": "b0d5b5a9f24c1169d9fc9c23506b5d4644fc91dbac7140652ca36476a7791b88f7da7d0e6c9d10e46711ef748657338a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875732, "uuid": "9b907bc6-4ee5-49e3-add4-47a9e39d7370", "value": "BC0412166C4D71AACC9533B7CB4B3E875CFB51AB4CA40039BD040A72A6906D9E7633E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875732, "uuid": "bce20885-9b5a-4fec-84bc-9a7ec9a3400f", "value": "3072:Vala0VFkDkaZuMh3lmBa9FpJuFDzsMCJCsHgANMxRhD28V4ET/0YVmUG7k9Y7Epd:Yla0VmJkQ3sBa9jJCP7hsHqP100G7k2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875732, "uuid": "a60a9b88-0343-4385-b84f-3f49e4409b6d", "value": 176913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875732, "uuid": "3f280045-281e-455b-8d35-939224e50d7f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875732, "uuid": "411e9788-632b-4e25-92d0-071cff43e8bb", "value": "9f16391e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b255959-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621871173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871173, "uuid": "00b7772f-fa8a-4850-abaa-17b6cc3f5e41", "comment": "Malware payload (SnakeKeylogger)", "value": "25db68c5a284fbef79cea1e61f37aa02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871173, "uuid": "a81750ab-516e-4274-a07d-108a0b5b662c", "comment": "Malware payload (SnakeKeylogger)", "value": "2ac8cf6ac077bd62d3fbf8bb604582ef76d5c83882ff9cbe3acfe24fb46f3d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871173, "uuid": "d8a65eb1-6150-4f01-b959-6586277e7aa1", "comment": "Malware payload (SnakeKeylogger)", "value": "d080b52cda75892ab34076a55ec93c51f2d82c84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871173, "uuid": "4ff19da1-f0c1-4e29-b499-75662117b374", "comment": "Malware payload (SnakeKeylogger)", "value": "d6a6c4a889a70c001225ff0e1118e10c417698f6e54f4145b82f5e9b361d6715b21afea6276062ac13543f20437393cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871173, "uuid": "4ffe3033-5b1c-4eeb-8102-046b08d3dfb9", "value": "6224382C1854FE26D5A385B8CCC6F1FBE1945F0675215B9F8B93BF27713322A24A10AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871173, "uuid": "878c2789-384d-498d-b3b6-75e37ea65a0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871173, "uuid": "f02d7c50-e923-48f2-983a-dffc55625e02", "value": "6144:Z3OXQhf/888tFyBtB6Ux3pfiDlQfJaBmcFAlQImZB+grQIvc7n8dQSOALR3bAIAM:Z8N37X++oYfwyRJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871173, "uuid": "1a2c4cb3-951c-45de-a942-ef4b28038dba", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871173, "uuid": "fd51e6b3-c684-44bd-a4c5-578baa415175", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871173, "uuid": "db4e9337-a975-43d8-a7f3-3ae26ba3b371", "value": "FLI_010577520.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18693b64-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814448, "uuid": "7da9cc75-11ee-4d11-9981-d63652b49cf1", "comment": "Malware payload (Dridex)", "value": "ab3d82ca42e375d9c53aa121b4463381", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814448, "uuid": "cf954248-26f4-4e6a-88c4-5496534f25ad", "comment": "Malware payload (Dridex)", "value": "2b1c433c3bcb94e5b0e5132324d2bbb213263a06b23f13d8f45bf0e25bfb76a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814448, "uuid": "5db68432-20dd-41f4-a8f0-2609a875e9d2", "comment": "Malware payload (Dridex)", "value": "c0d8f0e9e97b467db10fae3211c4cc1da24887d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814448, "uuid": "9cf28f0d-a5c8-4262-b249-a59ed9341f64", "comment": "Malware payload (Dridex)", "value": "3da55ac4942784b0054b3c81e3d7c64f19f9065b6f79cdee483a9145e11165217c5826557de58eaf59488bf4b2d3ede3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814448, "uuid": "e6fed0c4-24a3-4dcb-aa1b-44133631f0e4", "value": "BBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814448, "uuid": "4aae101d-0779-4c4f-b5fb-bcfee9e19859", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814448, "uuid": "935d42e4-883b-4a66-98ff-344d28716ff3", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814448, "uuid": "dabb31a7-0240-431b-ae60-a3210c34479a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814448, "uuid": "a75b8258-d37b-454b-9d4a-bd6fb41b9cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814448, "uuid": "a28e58a2-ffec-46db-93e7-22f18d070bc7", "value": "ab3d82ca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df11ebc-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890102, "uuid": "1cc7d3ac-cfea-4e72-83df-61a6ff307ef6", "comment": "Malware payload", "value": "b68cab2a027061c3fc589b77690dd885", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890102, "uuid": "eae3b4d7-0e1d-41dd-893f-cf0bd1f63ec8", "comment": "Malware payload", "value": "2bd14a4aae558abdb7bfd4225a436ad792c6fdd551a1587678c0c3a371366681", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890102, "uuid": "ec4af2aa-abc9-48c4-8d35-4efd7633a6fd", "comment": "Malware payload", "value": "969d68db3b72127db21efdbe6e5dbbec30b8beb5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890102, "uuid": "92b64b6a-cf8e-41e1-9cb2-4aae1b8aa247", "comment": "Malware payload", "value": "895579c0d1255b6fe80c9b3467141faeeff0eb63d3d7e2e163357518d1187591c242776f3f15c28de262f775f2ba1332", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890102, "uuid": "dbec4c55-8fc8-4072-97e0-e1b135a9a32d", "value": "ABF3E00AED9FE988E84C51F1CA4D363EE9713E361B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890102, "uuid": "128c0276-6026-4095-9c57-7890f89bcf38", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890102, "uuid": "2ff62cc5-9102-4a14-b6e2-275718b48f36", "value": "3072:eiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:VeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890102, "uuid": "e05805a8-4f73-42e4-9c80-ebcf7e51d51c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890102, "uuid": "7fb76d1a-c189-4732-a594-12288f56f4db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890102, "uuid": "07fa6a6e-fedb-4112-8e4c-630314533365", "value": "b68cab2a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb72268-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861378, "uuid": "55708b45-56b3-43ba-b4b1-9818fe233b6e", "comment": "Malware payload (Dridex)", "value": "c0f431b664d30b038e972e863d558cd2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861378, "uuid": "6cd9024f-f929-49e5-91c7-ef4274fb0bfa", "comment": "Malware payload (Dridex)", "value": "2c0f4ca16b360f229ce838b7a52c1dc4730bd078341805ea5d48a392c06d25e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861378, "uuid": "db818b44-3b51-4531-9559-624355617b8b", "comment": "Malware payload (Dridex)", "value": "bccae41b6f6652e7abdf878c2b08c740a03a0631", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861378, "uuid": "14c5e815-1885-45ea-a159-a952924d377e", "comment": "Malware payload (Dridex)", "value": "c7ac0347d9687bdc1aba4a2a10d624100ce92853b38d8a97782c287e19304dc3139c2f0729814f7915f939622e085921", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861378, "uuid": "99866fd1-26c5-45ca-920d-a8918348118e", "value": "F6F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861378, "uuid": "e1726cb8-6881-49ae-8d1c-ed0aa2553c89", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861378, "uuid": "0cd55941-ca89-4a3c-8e6c-0bc90d4a616f", "value": "3072:Vlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Vlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861378, "uuid": "f2b3c7ce-9aa5-413b-a385-751ae3cbd3c1", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861378, "uuid": "eb8d1d41-3153-4ee8-9096-7c5bd4a6ce50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861378, "uuid": "abf90262-2606-4b18-b040-b72e1b5bab39", "value": "c0f431b6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf3edf5-bca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621870236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870236, "uuid": "5190056f-00d5-488a-a85f-43e0c1ae28b7", "comment": "Malware payload (Formbook)", "value": "680bd70bc57824293d9412570c4d513c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870236, "uuid": "336e978d-39f1-4ef9-a9b1-e0be4a6d74bf", "comment": "Malware payload (Formbook)", "value": "2c2a9f8994da69253ed12b7c7eb917b0509f8e3f78e0467768f1e66f262ae74e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870236, "uuid": "dd606b91-fb81-40c6-94e3-473574565ce4", "comment": "Malware payload (Formbook)", "value": "4b6d16747504e12cfee53ad1896b3f8ffd313490", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870236, "uuid": "ea6649f6-6b2f-4d00-88c1-2a0a11980d3f", "comment": "Malware payload (Formbook)", "value": "ffce6636736da5901f1a17f53a8c9e7a843178485a61da03260141b0a18387ca316397fb2fba72e6730302f94e0924f0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870236, "uuid": "ab9bb5fc-5f29-4113-98b1-fcece69f23a5", "value": "60652311E8CB470AD19F9B3CD5AB817A1425DDB5AB6CD0A6340A39763A336F40BD372C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870236, "uuid": "4c1f38f0-5ced-40b2-a155-18ee16b52306", "value": "24576:7AGxDvGx9aohvnb+I/lDq4o9VcayVm+TwtAywWNjKl0FipNrd1HcP5:Bjcaohv//M4o9VcNXOAkNjKNrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870236, "uuid": "224f2e0f-1504-4c9b-83eb-5215e0b4f9db", "value": 1442816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870236, "uuid": "31e93f9d-5f13-4b59-b4de-524d2644a413", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870236, "uuid": "082aad7e-194b-41df-a9e7-067317fdcaea", "value": "NEW ODER - SS21-38.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b099d5-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621886592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886592, "uuid": "2cde6fee-36bd-4d15-ba5f-5ffc83839c00", "comment": "Malware payload (Quakbot)", "value": "640e7a3d0df4d344b36ede84175e6142", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886592, "uuid": "25385576-b165-41cd-b7dc-b5be596d0129", "comment": "Malware payload (Quakbot)", "value": "2c655de5347c4a143bc2e561c5df6aaba61dfd946af3d1de36c1f0e098e94ad8", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886592, "uuid": "d64a14a3-8970-4dfc-870e-e9bb7e0c5d18", "comment": "Malware payload (Quakbot)", "value": "180ac0d31fb90f3822f1f05064338c4ab4fc19c9", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886592, "uuid": "1308deaa-fc2c-4f9f-94d2-5046a22aa22f", "comment": "Malware payload (Quakbot)", "value": "40ddcad1c815d9a5ff9ef847eab3d67ac784c183d7d3a663323a247045d1b4733c9a4e340b9f2750aabb1ad373ef2d15", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886592, "uuid": "c3dea538-1e28-4880-a7fb-a999a88b9ee9", "value": "C6059E32B3A08437D1772AB98D9B56945C26FE103A34EC462BE41E9C9F393917B271D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886592, "uuid": "5d91cc3a-3610-4576-8268-34dd81bd1cdf", "value": "7173dd0bd0ccaed951e4a48d6d854c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886592, "uuid": "1ee1dda5-3d36-4f86-b5b8-dc10f5bf83db", "value": "24576:FXkqSDMHKR+ENns1af2by5WeHocqi8ORE:Nk4sPV5WeHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886592, "uuid": "5133a340-3396-452e-8de9-6ec1f250ce63", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886592, "uuid": "917c0110-2349-4bb8-9c70-caaf01fb5f43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886592, "uuid": "8b17ffa6-de8c-4e98-af0e-d6b6c597ef58", "value": "640e7a3d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852e8485-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893658, "uuid": "1235aa80-d8dd-46c8-8689-1cfa1ced5564", "comment": "Malware payload", "value": "1162359fb0c59f8636310ada50d2299d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893658, "uuid": "d4abcc1a-0319-40a4-a589-2cf5e6bdb706", "comment": "Malware payload", "value": "2c6d228f8c97e4b5df10a50235cce1c18b9f93709902e5c1054165793d029026", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893658, "uuid": "30f89583-936e-4eef-9204-fad9ebc78cd5", "comment": "Malware payload", "value": "91208481980b09b0a662e795c4168dd262f235e2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893658, "uuid": "83af8b42-0b5d-4002-988a-8fc4b59acd72", "comment": "Malware payload", "value": "5f7292def171fb3957f25d93d3c7cfb7793d9a1699e7e6517a786cdbfca32b420a0c3bd08517d2639089ee5547532e3c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893658, "uuid": "535223ca-5ad7-4228-b24a-8e4396bc29cb", "value": "1CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893658, "uuid": "5d489996-671c-41c8-92ea-299e909018ca", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893658, "uuid": "6261b921-de45-47c5-a75e-ca5a831b38c9", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893658, "uuid": "779040c0-ccbe-474b-8cf6-c4c3f6c9a601", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893658, "uuid": "93fbd599-b501-441f-8fe5-6057a2394e58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893658, "uuid": "ddc08c94-599a-4289-b579-002fadccf9ed", "value": "1162359f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcade84-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1621871177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871177, "uuid": "b5b5701e-d41a-4b02-b38e-6964f4713f28", "comment": "Malware payload (GuLoader)", "value": "f2b24a928f2f1013946dcfff9e6918c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871177, "uuid": "483fa967-8aa5-4dc1-858e-0f20e0315929", "comment": "Malware payload (GuLoader)", "value": "2cad3c6af2167827f44f2d53c36b8aed25c361cbe90b030a024dd13ecc649d7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871177, "uuid": "0630ae70-85c3-4f7f-abfe-5acd11d17bd4", "comment": "Malware payload (GuLoader)", "value": "1af0ab2cf5a0380ed8f58713df7a49f96b6886cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871177, "uuid": "82a21607-d1dc-4c8d-909b-f57830c2f23b", "comment": "Malware payload (GuLoader)", "value": "d849da75941cc48fadebe0d145450281fe6375f6b1f27b07d2ff486b07abd1aa2e1644e686082edb9368efdf69f1d141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871177, "uuid": "dabc5470-9546-4e59-a2a6-5bc2936a1391", "value": "54241A2AE6AA8426D6F04630D565C83E756ABC351049AF4BB3413F1F34B4F27F5B122B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871177, "uuid": "a9ebc62b-fde7-4d4c-8665-721acbb18209", "value": "16fdcfe1a438f1c855947e8a1cbc62d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871177, "uuid": "fcb76f3e-eb76-4c54-bddc-9d160d3952f8", "value": "6144:FMMMvMMMRhAMq7NJ6kqjzMite88zG2Debpn1zElpJs89bLTgWJ2r+QqTs0yTH6QB:FMMMvMMMRJENJ6kqjzMite88zG2Debpr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871177, "uuid": "7125bd41-7093-4b2b-90ee-35ac1695dd98", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871177, "uuid": "8064bbde-0c9e-46b8-8b34-22b817d55336", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871177, "uuid": "96a03bf8-bb66-4279-98a2-ff5e925da4fd", "value": "Quotation request (EUROL 05242021).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951b58fe-bc9a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621865767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865767, "uuid": "5541201f-bab5-4923-b4f7-e89c75c60896", "comment": "Malware payload (AgentTesla)", "value": "f684a1ae652577db0d415c6fc3e7cfb3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865767, "uuid": "fa669f11-3042-4a6d-9104-69caf0c33193", "comment": "Malware payload (AgentTesla)", "value": "2ce5a9f8be3febcaec5cd8354e4ba701508ee579654a770ea56244b0e810973d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865767, "uuid": "e31355c9-6519-4c20-87d9-80ca4908c409", "comment": "Malware payload (AgentTesla)", "value": "012e941183c503c077588409e08ea605611b65da", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865767, "uuid": "b5d0384d-af6c-4d03-b9c6-3be981bff002", "comment": "Malware payload (AgentTesla)", "value": "5c41bc9c309fb1df63932be88408cb9f3b4353fb9e1d2876e70b9349c026365de098c183c2dfb3c5d744fc5d7703d27e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865767, "uuid": "2c562e20-07ee-4ff7-b713-be6a0f318d65", "value": "2CA423F11A2B21EE1EB4333DC453634F99D0B39F6871AC7B424244D28CDB81B2666B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865767, "uuid": "de73101a-9770-4e24-9d80-a49f45f95ce4", "value": "12288:OJHtHXVGsE+poNtLLbykqd4lev4gcfMhIV0:OvXHEdDLLljrgfIV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865767, "uuid": "bd72db2d-68d1-4f1f-b31d-5168ccdef8fa", "value": 486702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865767, "uuid": "25ce4dc2-3740-4b7b-a9ee-0ee84badafe4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865767, "uuid": "7835aae5-b7b8-4114-9733-8e9462db2219", "value": "FedEx Express-Reciept.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd97b74e-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872331, "uuid": "655396ee-1480-4421-b63e-cc1429aeda7c", "comment": "Malware payload (AgentTesla)", "value": "09d0daa960a40f1d79f5a726a09ba1d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872331, "uuid": "ce0d12bd-60a3-47c9-843f-a6be3764a448", "comment": "Malware payload (AgentTesla)", "value": "2cec9b854e5111f7b5933c823251a1a44c3335d9a91c0ba7ca49a76eceac50d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872331, "uuid": "fd24bd3f-ccd2-4da3-b635-c6817b2054bc", "comment": "Malware payload (AgentTesla)", "value": "61db1112195abf77ec940f7cd937b6f559ffe29e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872331, "uuid": "08fbc7e7-3a5d-41a5-ac39-01309666a908", "comment": "Malware payload (AgentTesla)", "value": "591e961572158ead664fac09a14c905da0bbafdd2972b0745073cf8b2e6863580d4d666419cbdf00cc9f3ee715c95773", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872331, "uuid": "00bc5096-dcf0-4aa0-9c6a-6458caf4963f", "value": "0435595BF388BEA5C16D4E3880571E5D83DEE4533372F76F8294A4D27D01B8A4A0E267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872331, "uuid": "8825b546-ee5c-488d-a219-46bbae1a50d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872331, "uuid": "5d0dcb5c-0b16-410e-addf-acc2738d1159", "value": "24576:UgWoHUhTnky0cpvYsnO8txnButri8+sY:UpcITjzpwsnZV6F+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872331, "uuid": "a10b6d93-9a58-4637-b2ad-dcd118f12aed", "value": 1149440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872331, "uuid": "973fb2d7-3b28-4b38-843c-6464ffbdc69d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872331, "uuid": "13404173-c1ca-414a-97b4-5943b1cb452f", "value": "Uni-Pharma-0116PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c518a8d0-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "b8c05c81-1aa2-4ee8-97a9-32e102f7f16f", "comment": "Malware payload (Dridex)", "value": "70f777e125a5495ced05b71455155467", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "e1d59448-9994-4e42-ac5c-b99c87c45349", "comment": "Malware payload (Dridex)", "value": "2d805b68e53754d7c82b4e831cbd5bac68ecb09e76530c10fdc95c338656ad14", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "957536ff-db05-4bc1-9cc4-bcf1c1b9a4d0", "comment": "Malware payload (Dridex)", "value": "c0b2777a641d7d40c443586fecf778a08f2107d2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "9d485cbf-3c66-4ee9-a2a3-86c50102e160", "comment": "Malware payload (Dridex)", "value": "ccd7b7b3adab3dfa22f61d57ba6a05fc708246353a9ebd24c6dea2ecee8fdd91e31764a290d9dcc4bb59aa9cc3241478", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "421645f5-27dc-4f75-a6b4-5f0dad30d528", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "7c3adfbf-9e4e-4d26-8a3f-436fc444c872", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "1ca95162-9206-4ab3-8f20-83d71cd01f91", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872290, "uuid": "6a04acee-e892-4899-87d4-daee3fba046b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872290, "uuid": "df77fb96-a5de-4916-951d-2f7b31be97d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "393f61bd-3c3d-4573-a0bc-d2ca195a856e", "value": "70f777e1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc60b6d-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897266, "uuid": "4b674012-6da4-4947-9899-412a576cdb8b", "comment": "Malware payload", "value": "67f42eca4bd3548c1ababb0637ef9b90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897266, "uuid": "d7d489ca-1f2c-4e0c-8821-c53a3d08d3f8", "comment": "Malware payload", "value": "2db8e55c22c52f767bf68115572b869f484579bea43769a56b2a48c39a8f4e3e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897266, "uuid": "ece9b577-2c52-4e00-a58b-83abf7f904c1", "comment": "Malware payload", "value": "e7a8780fec060249c2e1eb8d57d982beeaf3154a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897266, "uuid": "f3c84a37-d76b-4d2e-863c-501860c57fac", "comment": "Malware payload", "value": "946389b70a971f863bff3ebb84c604c1212291df041a92ea641a2112f6896553d944a43aba1ab87713cbf0d780265434", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897266, "uuid": "c2626024-898a-4d46-b87d-c4d5dbcb168a", "value": "16F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897266, "uuid": "549fec65-817c-4254-866f-a175e6081e82", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897266, "uuid": "e1e9e2e6-00b7-4bae-811a-8d5e93c151a7", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897266, "uuid": "ef7e3e26-0da3-4af0-b551-08b2a1650290", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897266, "uuid": "cc7b7a26-81e1-4ed9-b720-d5cdb88649f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897266, "uuid": "284b422c-dcf3-4cdd-8703-f2a802922ab1", "value": "67f42eca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97995187-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864912, "uuid": "d3828532-fbb2-4893-a7d7-0fad44e0ff94", "comment": "Malware payload (Dridex)", "value": "8c1a200a877f9f354a521981fc242089", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864912, "uuid": "692b9e23-458c-4423-9b5b-8f20a850992a", "comment": "Malware payload (Dridex)", "value": "2e0ca7f6d0180b828ed90c33b479b19590da2de4a3f8c99fb80e55b1f4f62adb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864912, "uuid": "ad9c0aea-3a77-4dee-a443-2294d23b8c69", "comment": "Malware payload (Dridex)", "value": "06201c117a21029fd59445a73a03c57b32adffd9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864912, "uuid": "cd3d20bb-6a5c-48ad-ad1c-bedbf65b85f0", "comment": "Malware payload (Dridex)", "value": "4aa5f7cf52d639c21a03e38da233d8db6318b0286b8cf7113702836b44b62f51d00abe82bf8d68de8a18724a8b8b9109", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864912, "uuid": "9f5654d5-2216-4c35-abfc-6ddb6442c8ef", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864912, "uuid": "6a727aae-b454-4f82-a93d-3f669e49553b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864912, "uuid": "e78e64b9-41f4-470d-b0ac-bc818eaf1389", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864912, "uuid": "373de078-4207-4567-a6db-e2cf6b781330", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864912, "uuid": "10f6f6fb-cdcd-48c7-bc70-fc04fad5de75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864912, "uuid": "f7cde627-ee67-4a29-8e8c-73851c4e70ad", "value": "8c1a200a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3a51fc4-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846921, "uuid": "1fe90129-ce92-4acc-ad92-f905cd812f47", "comment": "Malware payload (Dridex)", "value": "ebc03e52e86ec032d48a3df3224951c4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846921, "uuid": "d1bb7c7d-f332-465c-8eec-00fdffec345d", "comment": "Malware payload (Dridex)", "value": "2e23da9bfa261b53cdcfafba9f2959699524e5837ff0abaddcb0c7010cde74ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846921, "uuid": "e74736d1-e52e-41da-97e0-e92aa7791099", "comment": "Malware payload (Dridex)", "value": "18a9bc5395bd148b15e082b8a47d4b9d6bc0a7d5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846921, "uuid": "180d883b-f2cf-4089-ad49-101564fd5cfd", "comment": "Malware payload (Dridex)", "value": "8a056eaf95f7b5e15dcf7555926562a6f47bdf46b70b1dbc6e6602df679f8fe653da2db30752f887d9766f0cc5395202", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846921, "uuid": "ff631cd2-1c1a-47cc-be19-31d0ba4ee8b0", "value": "63F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846921, "uuid": "073af385-3346-4d5e-be76-b2cd6488c851", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846921, "uuid": "7c8b9e46-6dd2-4fdb-a237-ca808af40159", "value": "3072:wA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:w3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846921, "uuid": "f911c84c-cb9f-448b-8352-99bb3d6df120", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846921, "uuid": "ba3e6541-41b9-4b25-ad24-6d1b57522ae9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846921, "uuid": "f282fe45-1d1f-408c-8b37-8d4f200640ec", "value": "ebc03e52_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3132be5-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897251, "uuid": "fbcc7347-15e3-4c02-b699-107bf752babf", "comment": "Malware payload", "value": "096d15a70da75f29551eddcead7bfd26", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897251, "uuid": "de87d0c2-2ab6-4469-90c9-c0a72c4ff0d9", "comment": "Malware payload", "value": "2f10cbaef0f215987a5d0ab07e149fcd11769a3cdb181320dba00953454a9212", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897251, "uuid": "5b5e82c9-1c1b-4bda-aebd-859647c4c847", "comment": "Malware payload", "value": "d67e850ab95ff99cba2ea84c45d887ad70ed0344", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897251, "uuid": "686486b8-a47f-4120-ab30-8cdbc00936cb", "comment": "Malware payload", "value": "60954a72d0c4a5ae86850ee355a03ccd7b2d7494c376f487c8e00fed3b6375fe6becff470947a9bc96ea84dbc4efed12", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897251, "uuid": "571af0d4-797c-4184-b9b6-e602bbaec681", "value": "54F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897251, "uuid": "29d66f8e-3cc9-4c17-843b-af2d9c4008e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897251, "uuid": "bfa96406-54a6-45f3-a9f0-c6a5c6eeade4", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897251, "uuid": "fe639bb4-c922-4b0c-8473-7ec3abe16f84", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897251, "uuid": "85f8cdd9-2906-444b-a3b5-c1b50de3d38f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897251, "uuid": "0c84d6a6-0c22-46f6-afba-02604fa078f4", "value": "096d15a7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054dd691-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868532, "uuid": "926d0894-82a5-48d6-bf84-6425db9bfcc7", "comment": "Malware payload (Dridex)", "value": "a65dd4cd52a3059594cf6c800fcbe659", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868532, "uuid": "9ed04eda-f954-401b-9178-77202d969164", "comment": "Malware payload (Dridex)", "value": "2f7637521237506eb0ce39befe18e749324c85032d9a05ff0e18a7fe12203f99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868532, "uuid": "c249d0dc-59ea-4fe8-a5a9-b5fb5098bcaf", "comment": "Malware payload (Dridex)", "value": "41c560584916c2767adb8571e4ef531ba4982c38", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868532, "uuid": "d30d9a8e-872b-428e-9239-a0530ffc4ee5", "comment": "Malware payload (Dridex)", "value": "b53763ddb942498c3c4aedcec0971441f0365ea9b6513b4f5835208bfcc82e1e5245b430e8faa2f4b432bf9acb97b560", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868532, "uuid": "a9a25095-2c94-4bb7-bcc7-b62cf879d878", "value": "8EF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868532, "uuid": "065026c4-595f-4b1a-81b6-7df51f227d25", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868532, "uuid": "6f037fde-700c-4b4a-bfdd-617ddb60dd00", "value": "3072:MA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:M3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868532, "uuid": "8d4df3a0-9170-48b7-a34c-2cf6b2c0bef0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868532, "uuid": "9bc87a68-0cad-4c3f-a4af-b458e8b2e081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868532, "uuid": "5626f771-244b-454e-844a-36babdaec2c6", "value": "a65dd4cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32baca56-bc56-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621836396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836396, "uuid": "94d3436d-d75e-43c1-b147-e4fd6dde291f", "comment": "Malware payload (RemcosRAT)", "value": "a2a13cdbc6274939b16298b2f3e2ab50", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836396, "uuid": "231070b8-92cd-43e3-b51e-571e4f8aa179", "comment": "Malware payload (RemcosRAT)", "value": "2f9a0a3e221a74f1829eb643c472c3cc81ddf2dc0bed6eb2795b4f5c0d444bc9", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836396, "uuid": "5d6545d5-3fdc-4afb-b784-f50819b61043", "comment": "Malware payload (RemcosRAT)", "value": "edd55556ef1c954ecdd1f09e9b71c435194dc466", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836396, "uuid": "2013b664-4854-495e-8cdf-ef60b1a05c6d", "comment": "Malware payload (RemcosRAT)", "value": "bd35649f9811353cb003682c12fb8b9706a659124fdc49dcee1eb9ed225c90879ce6a925979d4591d315e15e13c63ff8", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836396, "uuid": "2fac9bc7-45da-4e54-b0d1-0b106f12b87f", "value": "ED444AAA8BC9477DAA780527C0BE4B6F51F36716C012F8DC0AA61F5F7A1FD6E201910D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836396, "uuid": "33f2daf8-96b2-444b-95f9-f9d8396712fc", "value": "6144:+DHZ4saISUoglotWdsNH4Rq+5D+5WoIuMt9F3mN2p6n:E4saISUxlVE4RVXoIXYQp6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836396, "uuid": "697326d6-6cd0-440a-9f6a-d903f3f177b8", "value": 257775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836396, "uuid": "10def6e4-75bb-462e-a3d4-1fbfa726fb9b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836396, "uuid": "f59589c1-1c12-47ce-b463-bb7a588181a1", "value": "Shipping Documents-BL#SE20100078001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2d17d4-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621875738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875738, "uuid": "12d49e91-4024-43e9-8de7-35b55b4c827a", "comment": "Malware payload", "value": "6debf055972a6e56810d80ff802332dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875738, "uuid": "be9a0da9-9db7-4f9f-83b9-68678d3b4241", "comment": "Malware payload", "value": "30552647220eafbdd6428004ddad72df731dac361c5e93138dc558c6bc68ae11", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875738, "uuid": "610202dd-4c77-42e7-a6ea-c331a0875240", "comment": "Malware payload", "value": "1295c29521fb5bdce3a652589be949de6f1fef89", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875738, "uuid": "f10fe462-6ad9-40ed-be91-ed46050d8c31", "comment": "Malware payload", "value": "f0b093882c9fcfc71a7b4c2b33cc61656743e13a1edc97ee27ae3d44c700c7949872efc304e39d04569911217a9b4cf0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875738, "uuid": "474ac8cc-a482-42bf-88e7-3d465f24b7b1", "value": "BB0423D94B2148258C1F27F69F0A7E5F5199B8CAC4CCE945C3C49F4ADEC3A0B90A5B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875738, "uuid": "351fddd4-4c33-4abd-a94b-dccb6ace5e8e", "value": "3072:KwNTn+OSsDthjPUSPE8utR/1vrN9n/VcpYsL33L40lL4XxJX/N/lV:KwXnVPN0/1vrL/w9X408v/N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875738, "uuid": "568665d4-91ad-4743-8a53-21ba2022a995", "value": 176914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875738, "uuid": "2fd02b0b-4e41-4370-b654-2b3cd461296d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875738, "uuid": "7f8ba2f5-e315-47c6-acfa-58a40b1cf77a", "value": "6debf055_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8145c41f-bc56-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621836528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836528, "uuid": "94621716-647e-40ad-887d-578482ee7aa2", "comment": "Malware payload (SnakeKeylogger)", "value": "534644c1c903e53ac7d986ec7d973234", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836528, "uuid": "5dd0322a-dcd9-46ab-a1eb-9a88250cac06", "comment": "Malware payload (SnakeKeylogger)", "value": "3065a81e114873d9df17b935481954eb0c85edc342e6889b334f51c3f2e15508", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836528, "uuid": "51bd707c-f2bb-4e30-8a27-9e3042854a8a", "comment": "Malware payload (SnakeKeylogger)", "value": "bd6b90d58ff8ace0964d073809b40748a7cb7a9d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836528, "uuid": "31631339-7e00-46be-b19f-4b07b7511ddf", "comment": "Malware payload (SnakeKeylogger)", "value": "5a96d89afdc09d390613c4b6e8cf195270af41344aacaf10fdcc87c49bbbd230870a4f4c9e963c7e23bb601aa97cf748", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836528, "uuid": "30c7e8b9-6afe-4851-85e7-65aba2a1e39a", "value": "5A0523409D448286B293F40A9465ADC96C31D4C72809BEEFF5B047F67783ABBC67DCA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836528, "uuid": "be728ba0-c1ef-451e-a997-82d300837d28", "value": "12288:4wPoSpm6GS41TOzoKJ9BpUGJqKYbUvDzwBSlrnaMvsIcJcuyC6pKfBZnd4JTB9:hP5pmnScooKXBF2UXwhP6PCFZj4JTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836528, "uuid": "e19d612d-5b70-494c-846a-2770c97eafd1", "value": 805883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836528, "uuid": "4ddf7d7c-7ee7-426c-b651-6e1f3926c3b0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836528, "uuid": "f3ae7882-e187-45ec-a242-04ebb678b8e6", "value": "Shipping Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dce61ed-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861326, "uuid": "fbcc8c76-9c93-4023-856e-70cf5325a7bf", "comment": "Malware payload (Dridex)", "value": "011eaae97155d6d7965b62850a8700fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861326, "uuid": "aed90bea-200c-4f96-a8a5-c1568593d152", "comment": "Malware payload (Dridex)", "value": "3093128678e875d7782424ddeaff596ae8cae73aafcf454d7f302d77089ac6a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861326, "uuid": "0dc37358-1579-4f00-8e82-635dc71145d7", "comment": "Malware payload (Dridex)", "value": "1d1a5508a0775b544d6ae8348d77f2cf5cb9321a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861326, "uuid": "6b1584e2-3fbc-4ebf-88bf-418534bc9436", "comment": "Malware payload (Dridex)", "value": "582b616620f121bf41fc8a5fbcbe5c65c66165976b57e1daee688511c838f711b032f6e39ef6c9729cecd3e76ece3b75", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861326, "uuid": "a34a8acf-ef6e-49fd-b862-781e1fa6c46b", "value": "16F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861326, "uuid": "5b0adbac-fd0e-409b-91b2-d0608067c067", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861326, "uuid": "32359b5a-10cf-47a3-9efa-cc6cdea1042c", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861326, "uuid": "b7a505a1-8853-432f-894e-0833184ca5fc", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861326, "uuid": "debd6e87-f3b0-4f52-b7a7-e3bc794022f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861326, "uuid": "8b8f17bb-e91e-4f62-9e77-270514df3549", "value": "011eaae9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f4a7c5-bc94-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621863009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863009, "uuid": "f8dfecd3-e9f8-4ed7-b79e-4a0a79127b03", "comment": "Malware payload (AgentTesla)", "value": "720148618b70e5f40dac1b93538f0579", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863009, "uuid": "4ef31aa9-abcf-4d2b-9dd0-71af71097581", "comment": "Malware payload (AgentTesla)", "value": "30b158a268121de18c54cff5537cc764ed771dc686f6de731ff823e4430f68b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863009, "uuid": "fea91af0-6bc6-4cb4-9443-8483c603ef83", "comment": "Malware payload (AgentTesla)", "value": "624df544bd746c2ff666e4996fe8171d946eb4c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863009, "uuid": "62175397-b713-4b8c-a615-6ffdb0d797a6", "comment": "Malware payload (AgentTesla)", "value": "ee94be7339d69dffea96512790706ee5e57c7c72f5a1a5659d215971e013d41681870c291ca70ff7fddbefc3b7d86c7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863009, "uuid": "13a8092d-8931-4894-85a9-3d4f3410ea64", "value": "F6C4AE5172FA2F65C479DBF528A12A8407B5351FEDBCD61D4EC220CF29A1F118AA4F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863009, "uuid": "e5fdad07-08c8-46d3-8d3c-5f15c40a41a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863009, "uuid": "6b57289c-4d1e-4cc1-b557-eb86f444269d", "value": "12288:9kBSkoimDjnr7AQdHHqbl0u6+QTKJkGjzcmR1:zTDsKHg0RjGjzcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621863009, "uuid": "54cdfc22-7cfa-4d08-85de-5040fdbc0016", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621863009, "uuid": "b172e30b-a4a7-4bc7-928a-841475645fea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863009, "uuid": "509fbec5-3c8f-4189-b7e0-42074bcc5cb8", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea12ea45-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850448, "uuid": "abdfd8a8-562c-47e5-90ac-2747b2b1272d", "comment": "Malware payload (Dridex)", "value": "84f1c676065df7b587130d3f889bb244", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850448, "uuid": "692b6daf-8b35-4618-b225-66e3f9ed833e", "comment": "Malware payload (Dridex)", "value": "30c2b320d71f4e8bd1a55440266f1610c0a2a19e49e4b06b67f4451cb6b8214d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850448, "uuid": "ef3b3e11-e9e7-487c-9321-4412de26898c", "comment": "Malware payload (Dridex)", "value": "6d8f44e65c696cba546f2caae4c10ed8805a8e68", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850448, "uuid": "6328fb25-45e2-4aa0-8772-bb489bc889c6", "comment": "Malware payload (Dridex)", "value": "fd7b30090859b3f4ccea358e3a6617c6f3d0e78a96a578f7d11e6df6272eae5b155b9d213b81c4e82b6973922a2c3a1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850448, "uuid": "6d27634f-6218-4256-96bd-316dd032e938", "value": "F904B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850448, "uuid": "6f241081-0d4f-40b3-8a47-2bcfa6f91432", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850448, "uuid": "41681973-5136-4bda-9170-dfaf781de588", "value": "3072:9WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:9WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850448, "uuid": "316d3df8-3115-4855-913b-4f90ca19b98f", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850448, "uuid": "7c4f4ef9-8b51-4def-8e91-616a79fb479e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850448, "uuid": "d50b6840-bfbe-42f6-8212-2195d39ab341", "value": "84f1c676_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c2c14c-bc47-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621830043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621830043, "uuid": "b1465d9d-e535-4b56-bd64-fe9ae110f08d", "comment": "Malware payload (NanoCore)", "value": "b0c2665665e5abf78db722c5f8ef6638", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621830043, "uuid": "2a731873-b900-4559-af6b-1c19fe94a2b3", "comment": "Malware payload (NanoCore)", "value": "30ccedd667db53d5b9671da566a13669c109c57c96a0a07dec50252e396114c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621830043, "uuid": "30ea4d60-6ab5-4aa0-b2f8-ffffcdf798cf", "comment": "Malware payload (NanoCore)", "value": "f3a9cb875b70d67dc109906646dbcc99a1e80b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621830043, "uuid": "6022b058-4371-4e79-bf9d-2ae804a2557a", "comment": "Malware payload (NanoCore)", "value": "1a17767d17824154bf75c721458932fa814b67ef06b68f09f212d1a2a47f493621136ea2f4029fb52380910c288fd794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621830043, "uuid": "07087ada-43da-41d4-b043-760118cc7153", "value": "CCE4E12A6768DE15C0BF477E9021022497F0E2158603E75E2E8561FFBD73762CA226F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621830043, "uuid": "cd726c2e-2a44-4061-b408-121fa5a42332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621830043, "uuid": "6d49e9c7-9e5d-4ebd-9322-f1a0fb84b758", "value": "12288:MBwCjrhy3QCay6AFKzL6wkiZ/Rfd2hFejbwXywOZ7gEJ8csVJ0JH:8wCjrhy3QCapzws5fd2hubAvOZ7gPE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621830043, "uuid": "bac1dbbb-25ec-4eae-963a-fc308d12074e", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621830043, "uuid": "fd3b6adb-2aaf-4a04-8f99-cb528663a680", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621830043, "uuid": "b20ea162-c20b-435f-8bc2-8678a914f9e6", "value": "B0C2665665E5ABF78DB722C5F8EF6638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f326577-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872495, "uuid": "1f5eaba6-e0c5-4753-9795-35c4c97b8a1b", "comment": "Malware payload", "value": "3214959233726f37d45c0f41ed6eb844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872495, "uuid": "f281374b-13cf-4a0f-a9bb-751ee7c1c0b7", "comment": "Malware payload", "value": "3149cdb07c535db9316160f19a32b73a31cdd4d5fd6e971518b88d45db52af7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872495, "uuid": "577dc8ef-e659-4a29-8a59-2c53c4e0ac26", "comment": "Malware payload", "value": "18bb6a5fee2a894c37b17234768696481fc2817c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872495, "uuid": "539f8c00-f25a-4fda-8624-584f47fcaac3", "comment": "Malware payload", "value": "11daf238e536e1c7ee1b70fa29f8df8fad3121652eca51a6bd59a115c4893fe86af49fd51fad5d6855d945bf38fe44db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872495, "uuid": "8ffeb3f7-6eea-420b-ab4c-e7dfb7d53f30", "value": "D725263CD06AA122C169F2794ED4442BE550DF33E131AE15ACC3F7B85639E80B991E7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872495, "uuid": "b1f5cbb7-32f4-48f1-9e59-fbdb0bd589a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872495, "uuid": "9a06e637-c1f2-49f4-86d2-f3b00137f872", "value": "24576:z+BC7vwGO7NedGY9BnM6MY+z0Uo/e0FCyiksXz:z+BC7vwx7qj5MY+z0zeotiZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872495, "uuid": "9663737f-11d6-4c44-b2ec-2cb7e480156b", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872495, "uuid": "9a7d3c46-1789-46ee-8f48-61c59939543e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872495, "uuid": "0ae746c0-21dd-40fd-b5cd-6f3442766689", "value": "puchase order 24.5.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c81829e-bca3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621869618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869618, "uuid": "8dc07d20-ba08-448b-910a-21df91199b12", "comment": "Malware payload (SnakeKeylogger)", "value": "c99828bb65f873cee05132519acd4fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869618, "uuid": "32503b53-5ac6-4009-afb8-5b803b3801ff", "comment": "Malware payload (SnakeKeylogger)", "value": "314f30844d4256bb6f46b165735ba64d89eee8d40a021410c7b185f9ead8a715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869618, "uuid": "df397df4-b10a-44ca-bcfa-89df8f2d1c13", "comment": "Malware payload (SnakeKeylogger)", "value": "8ba79d4c9f0c19dd3c32bc30f8289462c1c88c19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869618, "uuid": "bf73d195-d5b3-4d6c-92e8-ab3524e61565", "comment": "Malware payload (SnakeKeylogger)", "value": "b2cfd34afc9d81583ea51f244236dbbbcc31ce48a112983f20bb39a5871d203a7ca49e1d08b3a3e08e33151e1f66b618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869618, "uuid": "d927eb65-42d8-4f6d-a3db-ce67eedb62fa", "value": "F0A4CFAC3394B69FC867DE32C9741C10AA25B867972BD34BA053155D8D0E6EACF107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869618, "uuid": "a4bf7b77-c853-4d05-ace6-010d03f367a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869618, "uuid": "f0d21f46-dab0-4799-9234-df8118943ab3", "value": "12288:+/Y9KjjFPvz4t/kq2RhBvdwZvaH66IyU:+g9qhP0kq2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621869618, "uuid": "222a5a22-a8d2-4d6e-a55d-b1dcb2b515b9", "value": 478208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621869618, "uuid": "de94a2eb-716a-44f0-9762-af82d6a531a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869618, "uuid": "f06df2fb-9877-421a-9654-4e082d7c6056", "value": "Quotation#975072.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed3c092-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850456, "uuid": "a644bc7b-1e2b-4379-a254-422d5fba452d", "comment": "Malware payload (Dridex)", "value": "8b947258fbb76ad5ee8f8a838b78d664", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850456, "uuid": "a0d3a056-5773-4884-85e8-6139662f24c5", "comment": "Malware payload (Dridex)", "value": "31a0ed5ee29e30a1f1a57b0ce4a3f41b8b3794872d65a7dd8de57d43439a4895", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850456, "uuid": "5c7be871-270e-4822-9724-4660e1418336", "comment": "Malware payload (Dridex)", "value": "32d3f3b1e1b82e43face8848fc40d785de0825b5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850456, "uuid": "81361a29-4c0e-4e44-af12-73cd2d13c030", "comment": "Malware payload (Dridex)", "value": "602dcc3518cdd2683f535ccc7bab0be32f12afd118507db5d76ed4ae483ce7c9a46cc49946ffd012bc80d6717fba67c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850456, "uuid": "49c4c370-d521-4a8e-ad9e-80caeca78a97", "value": "F6F3C088CBB3E4E6EFB3937966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850456, "uuid": "dc0cc66d-3569-428a-8e00-c1252c3de344", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850456, "uuid": "9bb9f45c-d724-4dfd-9e8e-cce2e33a3f1a", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850456, "uuid": "29760a8f-1c28-4c4d-9794-dcd5af71b08d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850456, "uuid": "7ba81449-3925-43bd-be38-64e3d2af05ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850456, "uuid": "7205af55-6491-463a-9a81-5d833874da34", "value": "8b947258_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c4131a-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850540, "uuid": "a538107f-94fa-4b99-afa7-8f1a5ec86161", "comment": "Malware payload (Dridex)", "value": "e695545a4bf93c19917d3383b096ff07", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850540, "uuid": "2e2fbf61-b942-47ae-b7f8-e4328e37567c", "comment": "Malware payload (Dridex)", "value": "31a18bd427a30d98470c955bcf67d27d16927fdbd09cd5b85c1bc9a073d75fb1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850540, "uuid": "201e51ec-52e5-4784-8338-f3146144e5b7", "comment": "Malware payload (Dridex)", "value": "f0e172b438b6fc2988f54f5216465f92650b86e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850540, "uuid": "d65e54f8-3bf7-45db-adf0-25b1d5fbb86a", "comment": "Malware payload (Dridex)", "value": "e87fd78c10bc6e087343649b50e820f4fed5e61244a13a19c27e5c86fe71e7659b2b5868db41a02b041d7d8ee8778c93", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850540, "uuid": "2fb4129c-265f-426f-9cfb-fa641487f46e", "value": "90F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850540, "uuid": "4659ae00-6891-4ac1-ac25-d875a83d0e8d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850540, "uuid": "81060f50-e3f2-4acd-b2f3-017aad516379", "value": "3072:viFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:keAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850540, "uuid": "2d02c5f6-b0fe-44e6-abfd-8c792f41104b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850540, "uuid": "ad56de78-b48c-415e-bf1d-effa89064c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850540, "uuid": "9bc9ef37-375e-44de-9285-4e2c80ab51c5", "value": "e695545a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a148f4-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882982, "uuid": "3848f30e-8642-459f-9774-36e86349e767", "comment": "Malware payload (Dridex)", "value": "8f149c769ba4dca92a43a0c5e8bd945b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882982, "uuid": "600669b8-0bbb-45c3-ae29-fc59dfbb7cfc", "comment": "Malware payload (Dridex)", "value": "31e56af922855de6f113411defc8f2f1fd0f69db5047311012b41a70b621ff0c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882982, "uuid": "886217c7-b43e-44a1-b65f-5e20ce40a766", "comment": "Malware payload (Dridex)", "value": "d86045e19452f34c065876543e9d80f286613c41", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882982, "uuid": "fd7f0ad4-4e2f-46d1-b9af-43bba6e94631", "comment": "Malware payload (Dridex)", "value": "7ed131536f8b74850534b5f6e99138deea151ac4f91c5deb307dc2b25aab6f89230b5a22687918d86b3e54c2446db0f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882982, "uuid": "606fbba5-0d94-40ff-9203-aed78eb38673", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882982, "uuid": "47064e0f-7113-437a-8b6f-356e1957e286", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882982, "uuid": "9ba85217-9a81-464e-84bb-3c984346d24e", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882982, "uuid": "4cf07770-ca36-4a61-bba2-d27809ff2e30", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882982, "uuid": "9fa32fd9-baa9-444e-ae07-2a2d14ec378e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882982, "uuid": "71573732-6b9b-43e1-a42f-35dd1bfc8e1f", "value": "8f149c76_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be20d660-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621879150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879150, "uuid": "a0750eac-a14e-4dbf-a491-bc93aa3ee34c", "comment": "Malware payload (Gozi)", "value": "e8a3c694fc39f2fc11cc98a039092d9c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879150, "uuid": "268cecfb-0ee6-4e94-a0e5-43240c4beba4", "comment": "Malware payload (Gozi)", "value": "31f3e3dff9f4a1c67b4358b3dea34a4c1ad3ad98f5d58006071ec82543d7ed08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879150, "uuid": "0d3d5fdc-7ce7-4f86-88c9-eb50a8983b25", "comment": "Malware payload (Gozi)", "value": "5a997bcf52469b57823d7aa171a2d6debc70800b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879150, "uuid": "0dd7b46a-1073-4733-8278-f270500ae42b", "comment": "Malware payload (Gozi)", "value": "f45318e2fd7f04e28823e9f9133c8e48ddc51cdef5042a2ef9344be53f2e37ac615312bca78b2bd19ca5c3e655c136ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879150, "uuid": "3a9fc651-41d9-4eba-84e3-2f6d860e5e58", "value": "0015C03138C1C232D573A0780A69D6B04BADB4301D359B9F77DC2B7E6F715A092369AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879150, "uuid": "8f6692c5-7d94-46e6-9325-ff294c91a3cc", "value": "7a79d10b1d4343a18a4f6e25e165b4ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879150, "uuid": "4610a35f-321f-46c7-875a-99512132c415", "value": "24576:HQfpzjXPgfg8CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgkJV4OaIRj150CpNiLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879150, "uuid": "501131c5-d33f-4473-990d-1af9dada5301", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879150, "uuid": "04f40f5d-adb7-447d-93d8-674b6e0e6d02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879150, "uuid": "7b24f81b-daf2-4fb3-95d9-cd77eb01c5b9", "value": "e8a3c694fc39f2fc11cc98a039092d9c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcce337-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621854236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854236, "uuid": "bc34b38c-9b26-4a95-944f-6c5435c345a5", "comment": "Malware payload (AgentTesla)", "value": "57d2373c53ba35ac6692d313428f8bc0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854236, "uuid": "d1cb9458-07df-4cdf-8a0e-1a13ca5b74d0", "comment": "Malware payload (AgentTesla)", "value": "320c4152b2baf887963bff7f739f2f4017e46c55113e98f930de353931080b48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854236, "uuid": "7822dd8a-b094-4e25-afa8-18de9693d8d2", "comment": "Malware payload (AgentTesla)", "value": "b840720f0b9452ecfdb7bb3a12cc8d15f20be9cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854236, "uuid": "1f94bb66-6925-4c44-bf86-730da4ac1562", "comment": "Malware payload (AgentTesla)", "value": "653f52b43ea9357ef08c9d73d0ad1809aa5cb491e21cb162fc70c666aa036ae7aa9542b691cac906471d1b581e430fbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854236, "uuid": "28eab867-ad5d-4374-8a2f-ecffade8ebf8", "value": "9EB423E075DA5025BE038A956F5D481025AFE3E2E2CEDA11EECD53C80CB2FC9B61F165", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854236, "uuid": "85174f52-66a6-4282-9c67-7e527c123053", "value": "12288:9D1nUfaXeGB8UpKq2WkVpRpjQqIVqpmWxOZ8o1j+E5uBP:9Dyfau48o2WuRpjiqsbZ8o1jqBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854236, "uuid": "f94df254-31a0-4a0e-8af3-5ebcea10c280", "value": 499024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854236, "uuid": "d4b9f402-ad02-4422-88ce-35a771eabf7b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854236, "uuid": "8d97bded-759a-4a4d-9687-6b122c8383c5", "value": "PO.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc34bab-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879442, "uuid": "51220755-64f9-4de5-a1af-8ffa61c849b9", "comment": "Malware payload (Dridex)", "value": "3760c901bd9202c289034d6a27396ce0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879442, "uuid": "53c22888-7f5a-456f-9320-5413e934b88b", "comment": "Malware payload (Dridex)", "value": "325f3e59e91ccbc0fda5980a0f592d34a934e7bf7f7a905332f919213a22f334", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879442, "uuid": "164ec5f7-cc70-434d-afa5-46d1972461ed", "comment": "Malware payload (Dridex)", "value": "1e566152795219d3e549474e9187665df73175e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879442, "uuid": "26f17d8c-052b-4885-a315-709ef4538555", "comment": "Malware payload (Dridex)", "value": "93e5e013cf107ef6477f0f6c9f6a354444caae0c255595950436c06db88b80c17210cd85af5acfd957ec434730e62c7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879442, "uuid": "0072b599-b55d-4838-a73d-73f8033493a1", "value": "B2F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879442, "uuid": "91d1f175-76c1-4d26-8f48-9b8df2608ff2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879442, "uuid": "f703803a-b23b-4abf-a096-97e20188046b", "value": "3072:Zlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Zlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879442, "uuid": "de33c55f-137d-4ac1-ad56-5e68eab61f04", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879442, "uuid": "55aad4a4-1449-436d-9750-f080f15d82f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879442, "uuid": "eabed076-d80c-49fc-b256-575653fe0d27", "value": "3760c901_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff209a3e-bcb8-11eb-875b-42010a9c0053", "comment": "Malware payload (Stop)", "timestamp": 1621878830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878830, "uuid": "f9fb0c09-17d5-4397-9463-f2eeeea2c9af", "comment": "Malware payload (Stop)", "value": "a6f049a056e37a65280ddfe17f689b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878830, "uuid": "992a3866-632c-4b79-ae9c-d9ec0bf040f3", "comment": "Malware payload (Stop)", "value": "32b0fbaf95fefcc9b89243be8721625592fc9ed92d76a48cab263898fd3d5c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878830, "uuid": "81c96e6c-d36d-45d2-be6f-c4c8476b963f", "comment": "Malware payload (Stop)", "value": "479e08954d4d58b643ada84da280bd01c71e779a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878830, "uuid": "ee6a4b83-efff-445c-ab23-1e25a5486c3e", "comment": "Malware payload (Stop)", "value": "8b91f72622215019ddd68c33f56ade8e47f4b2a32ca08383056c795590e0de8c32185181054be2a0445a29e7ec38a59d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878830, "uuid": "84756c0c-329c-4298-917c-404f975fb871", "value": "7205F120B6A1C034F0FF56B446B5C2B8A53A7EB16B3440EF12D53AED56746E5AD3038B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878830, "uuid": "0a51e19a-306c-45af-a257-f53239d53c5f", "value": "804961db55ba5c190e654e6d23768444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878830, "uuid": "6e4d1df0-5713-4a63-8997-cfc53407f983", "value": "24576:40bAk9PkFMVNgsbj6d2dXrpcpZBWGyDs1lwBUeF:PEGNgsnHDIZB/yDseB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878830, "uuid": "e953b41d-7cde-4edd-bcc3-77842097df36", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878830, "uuid": "4882fbef-b412-4eea-96aa-979544c3d8d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878830, "uuid": "c9ad22c5-82c1-4522-b2cf-b61d0536c34d", "value": "a6f049a056e37a65280ddfe17f689b50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec46566-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621876038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876038, "uuid": "80cb016a-b34e-42ea-96c9-26aa92f52e96", "comment": "Malware payload (Dridex)", "value": "64f4f03b3cae1f1467451841be84647f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876038, "uuid": "e983cbe6-6b33-42f3-bf1a-cc8f35cedb48", "comment": "Malware payload (Dridex)", "value": "32bbfb3251f91028c2fe550e4455704160e7397f1086d4ea899e9ef4dedb3350", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876038, "uuid": "43ee0684-c113-427e-b67c-9efd110970ab", "comment": "Malware payload (Dridex)", "value": "d2038d22e10f7b6c4c41fbed81956c9d77a8f9eb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876038, "uuid": "0999e2f4-b7a6-463f-8a32-572ac8f4b63b", "comment": "Malware payload (Dridex)", "value": "aaad5cafd2e1dfe1687eb7d603aa94516270447b34c0dca69025511ef479bc9625ad13b7ceba4eb4bceb9ccab99ec2a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876038, "uuid": "c35b49a7-036a-4366-ad65-1cbb048e2bc3", "value": "EF04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876038, "uuid": "2ed64343-6380-40ac-98cb-e58622e58147", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876038, "uuid": "ee53347d-b913-4992-beaf-0fad38051f1d", "value": "3072:vWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:vWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876038, "uuid": "122002e8-55b3-48ab-845d-fbc10c47e3d5", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876038, "uuid": "785c7f62-e89b-42f8-92be-2f2ec54b4d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876038, "uuid": "3e7cd6ba-c772-4638-825a-ae96aad9b418", "value": "64f4f03b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade0a8e7-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893726, "uuid": "f76db091-a25a-431e-9682-591beef4a841", "comment": "Malware payload", "value": "b8b4d303388e9654d2688499efe5d5f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893726, "uuid": "63219376-183a-4deb-b5f0-8fabe58a73cd", "comment": "Malware payload", "value": "333b6b1e063e31fa7c1ea3a6f41c12ff3f96222705523aa0f3d0d2269c1320e1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893726, "uuid": "f0e377f6-bc29-4670-bd81-53afff662e74", "comment": "Malware payload", "value": "4aa2293e4c814ecc97b4b73d69c95f48d02bec33", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893726, "uuid": "e2c6462c-3238-4714-9791-87f41949b18e", "comment": "Malware payload", "value": "1dff310f851f4ddeb0a0666a62fb7aaa10b2983db0f6e26164b40974ce957dfb24ab7a4ac2313702c20561d781587c27", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893726, "uuid": "54fb8b6f-56fb-41e9-a28b-37c55e62f994", "value": "15F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893726, "uuid": "48e90279-bd73-49de-b8c8-3263cee70764", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893726, "uuid": "e3b5f8b8-e567-4942-bad2-fc33b9c80bb6", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893726, "uuid": "cf5fc2aa-539b-4007-a624-d6e70bf9cf56", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893726, "uuid": "4b15b00f-3c19-4dbf-a289-9bc487e1a3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893726, "uuid": "cdfe0e4b-6706-4b12-a33e-88d23153a8ec", "value": "b8b4d303_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d5a4ae-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846869, "uuid": "3beec139-d0a4-4abc-93ce-6c198b193139", "comment": "Malware payload (Dridex)", "value": "c68929f40dec20ca8d36dbe8c5e5d697", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846869, "uuid": "9cc640b1-a096-45b2-87b6-087ae68b69ec", "comment": "Malware payload (Dridex)", "value": "337b6dd8c0da658dca10af5555d2be12a918b21548b5ebd14f7aa23bce98e399", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846869, "uuid": "0db3fcda-9adb-4654-a32d-bdff28235e6e", "comment": "Malware payload (Dridex)", "value": "868d8138224987cf165a7ebc39c536d2e8765e67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846869, "uuid": "bde8a48b-da18-4223-9e3d-8f5580dd3403", "comment": "Malware payload (Dridex)", "value": "a9b10a45f8081a7b6a04139204ea5a414f1003f838f3d0de1b4e19fc9f2cee37f261f60141c935512388ab08bcf9f3b9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846869, "uuid": "9b2a2bb7-566f-40b2-8a6a-7a4f520e9a37", "value": "4EF3C088CBB3E4E6EFB2D37976F85E1B460674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846869, "uuid": "2c05a14f-07c2-4370-ac76-6d0fb58ddc76", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846869, "uuid": "99be080c-46f6-4404-b95c-b831f523d81c", "value": "3072:0IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Nc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846869, "uuid": "8a23d10f-5b61-4316-ad6b-e6f2a0b77ae3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846869, "uuid": "309cfce2-264a-4992-9ddf-919ed32d1ae6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846869, "uuid": "a48c7a83-4296-4b98-8d77-9e237c2f2aa7", "value": "c68929f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58926ed-bc4a-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621831516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831516, "uuid": "2d6cbf0e-121c-49b1-be2e-3b6c5dfc2ce2", "comment": "Malware payload (ArkeiStealer)", "value": "b372f8b11308e0bed273a2959b57b648", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831516, "uuid": "58597e6c-ae1b-4ea6-a851-8f6daf8b0b64", "comment": "Malware payload (ArkeiStealer)", "value": "3411ffa29608d19dc77f53571010425fc94abd5dac92d6c2abffab6eb468c0ea", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831516, "uuid": "7dd964ce-f8cc-42d2-9933-1d92659d3681", "comment": "Malware payload (ArkeiStealer)", "value": "76aac511d80ac24417c81d2d5dab5a1b43049906", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831516, "uuid": "22c7b0c2-6e4f-4877-a193-f53eb65091a5", "comment": "Malware payload (ArkeiStealer)", "value": "2321985cfea5ddbb4acde24a40db567b90764dd684d70698115d734ccc48feaab6f044b053680bfbe636a4844ce69427", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831516, "uuid": "8d83c94b-247a-4c0f-a8b5-8bd2ebe9f567", "value": "B974AF10A7D1C035F4F322F84A7693B9993E7EB16724A0CF62D52AEA5A346D0EC31747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831516, "uuid": "db6d6f62-8be8-41e5-88e4-f9cb47b920d6", "value": "1b20e823590a65ad6d345c463b7a7297", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831516, "uuid": "9766d9d8-60ff-4431-bb11-4e10f0bbb05e", "value": "6144:qG2QnjImNoWUtMQPuJYgA38RNKaoImpLUse8wLuoStEzLKSt:cQnjPNoWUtM0uMMRNvhQnoyEHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621831516, "uuid": "6f1f8c45-e6f7-403c-8a7d-03fdf3ad1753", "value": 364032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621831516, "uuid": "d27c6f5d-76cd-49bc-bb92-a9fbae1c2200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831516, "uuid": "1cea6955-7205-4178-81e1-a5039b8cc510", "value": "B372F8B11308E0BED273A2959B57B648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9264e5-bc52-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621834752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834752, "uuid": "398519bc-186d-4c81-8dda-e78a2925af97", "comment": "Malware payload (SnakeKeylogger)", "value": "77aa94b85f8c31d3741e5866cdc2f33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834752, "uuid": "599a02f8-1b3a-4a67-91a3-b1687a328756", "comment": "Malware payload (SnakeKeylogger)", "value": "345b9c50776b056862a2120a1073ea1d8800c5f2afb74c3e9da0b707cc6a80b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834752, "uuid": "fa6ac598-8e5b-406c-a0ae-2d8e6624fdd0", "comment": "Malware payload (SnakeKeylogger)", "value": "11a752b5693c5fe0a72e3d956d2a4e145e6a1606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834752, "uuid": "75f2d631-64a3-4ee7-8ec4-6f05ea731050", "comment": "Malware payload (SnakeKeylogger)", "value": "b6e2c6fddace0696760f50f95efdb2c38a7634786627421f08c5bd6e6bd03ac497562dd2023b7785568303910839030e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834752, "uuid": "fbcbead0-9a9d-4077-b490-1a2211a292fb", "value": "8DF4E0A113F89F65E03C43798474E8204FF1AC5BA679E705BDDE31AA6FB2B814913706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834752, "uuid": "592144c4-7ae4-49e2-9353-85c0d430c2c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834752, "uuid": "06108dd7-6176-4d8d-8905-1573f525802d", "value": "12288:NQaUE7EtgvgCshToXq0tJ8pStM9b2T+AY9l+Lcs8KfVKzg81M:EVa8oztRa9KT+AY9l+Lt8Kfgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834752, "uuid": "f54e76cb-7c34-4f4c-ae7b-c5b96869e7f4", "value": 759808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834752, "uuid": "1aadd8ce-43be-41ee-a3bd-ccdfd5749d78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834752, "uuid": "544527ad-5de2-4044-a07d-c3d63ceea781", "value": "NEW_ORDER__WJO-0001,PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55514547-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814550, "uuid": "7794286f-66d5-4422-844e-57bc4ce586fa", "comment": "Malware payload (Dridex)", "value": "eae789bdbddd822541e00634814c3b4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814550, "uuid": "6ef6316a-8a3f-482c-90e8-cb5244e8277e", "comment": "Malware payload (Dridex)", "value": "348780ca99a0ce5d416288002c908f065546808e4a46720776de1aece895927c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814550, "uuid": "42a34e99-c674-4f1d-a983-8144f3822fd9", "comment": "Malware payload (Dridex)", "value": "7b27ff9c13e851c34c6144baf5b306cb99319063", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814550, "uuid": "4f9199e8-47d2-47bc-bfa0-07483b7d4997", "comment": "Malware payload (Dridex)", "value": "4accdf9b12862d8860238e5f372f0aecce7a15d740cb925a49a5e7f9ff33a32aba3f53880585d576abd2a9c886a382da", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814550, "uuid": "ddd16abc-09c7-4dc2-9869-7e565154b787", "value": "C404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814550, "uuid": "30f9dbe5-c157-4de5-92e3-97f60d57904d", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814550, "uuid": "bdeb4eb4-8212-47fd-be27-3894b8a9eb41", "value": "3072:DV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:DV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814550, "uuid": "936b2a0c-7b30-49a2-8941-e31ff5343ce9", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814550, "uuid": "212f4092-1ba4-414f-82a8-ba6de55b4e80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814550, "uuid": "45afa1c1-5eec-480d-95bc-460be4a9156b", "value": "eae789bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d16ae0a-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871230, "uuid": "5f14f503-9fe0-4c86-9cfa-c7ebfbe2c695", "comment": "Malware payload (AgentTesla)", "value": "1a573f0aba890db5347418c93efb3fbb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871230, "uuid": "1c16d87a-75b9-4655-84f7-7024ac6ddbe9", "comment": "Malware payload (AgentTesla)", "value": "34c668d0a84046e43f1b11fe25883783b8799c6f8cdbca6e7be78b4074b4062d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871230, "uuid": "03c23ab6-6a08-4fc8-a566-d75ea73ffdcd", "comment": "Malware payload (AgentTesla)", "value": "9a6c4976f29237258c8784343ed1f493b86d8d8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871230, "uuid": "ffbd2117-dac6-4143-8235-910712d71985", "comment": "Malware payload (AgentTesla)", "value": "9e295ce5a887196a9293f7e3072ed6c9a805c12e8fd65093a8da43a1cdf076a34ffb1c562acaef9661506feecefad54d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871230, "uuid": "d815165e-ae48-42a5-9a33-368acdde3622", "value": "C825271F2E99E119E1D8C67D46F8402BFF42CBB3203AAED698C7736D0694D41B85162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871230, "uuid": "8746375e-519c-4005-8b7b-c0f06583b8e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871230, "uuid": "95aaceae-3d3b-4209-9430-e3494a03d602", "value": "12288:j2osBCWVcrNKawiIyrv9AKNSM5ADcsdZKVzMwgaHhGQm7XCB4HqDsvR7:KBCWwSy+FcAD5a5NgEOSB4HqAd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871230, "uuid": "7ecda69f-3018-43d9-9ae3-4120c067bc10", "value": 1001472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871230, "uuid": "774679a9-32a7-44c8-8b74-3479fd4d372f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871230, "uuid": "04f2ea56-a8fb-4853-bd7e-d1a700158027", "value": "PO76665.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c51f24e3-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621872290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "897f5dea-f009-4eb5-a11e-99ad616fff5f", "comment": "Malware payload (RemcosRAT)", "value": "457d09b7ec66f55a889881e833339702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "34ab3d4a-dbc8-46cf-8135-67e1d9a8ff50", "comment": "Malware payload (RemcosRAT)", "value": "34cba65e36ac56b25df317f25311f03fe34ed9f5d518518edf7b00db05134b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "6a942b85-a366-42b7-89bf-ed3ed313d63d", "comment": "Malware payload (RemcosRAT)", "value": "72c74c87d711abedf2b6fa6781c1a28397639fe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872290, "uuid": "2cfb0ff9-5f07-46b4-b2b3-55892c1d452e", "comment": "Malware payload (RemcosRAT)", "value": "f29d35bc86288e9a0e30dbbfac159b14370fe07c4054ba9925f1f9fcd3960d15ba5146a8230786a59e0a8149ab3384a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "bcd25632-5c53-43e1-9aec-917e90cbf535", "value": "13F49D62F29000BBC56E1E345C02A7A55929BE303C3458B677F53E5C2EBE6613E2D6D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "f777c43e-fe97-4dab-bbff-4c989b2d52db", "value": "d87d9fdc6b6d5d588c0b63d9011cbcb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "0c6a9982-c879-49ac-91d6-6e5d8ba61448", "value": "12288:mnjVUBb1kR2Jjk6t4GmRiEF3jbR/6upi0MQyjJMEacp7xmNs:mnJUdu259mRiEFTbR/6l7QyjJhLes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872290, "uuid": "38f7cabf-8266-47a8-96c5-44f13cbfafc2", "value": 793240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872290, "uuid": "61c7237d-d80f-41bb-bbe9-c84b422c284c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872290, "uuid": "a9646630-b457-418e-8e3e-25a2ce4a6e4c", "value": "URGENT ORDER 2T6U545267,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8628ffd2-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846844, "uuid": "af43e9ca-bf50-47a6-8c28-b97bb04f2467", "comment": "Malware payload (Dridex)", "value": "4ff527917829c009842104d584d66a11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846844, "uuid": "d4aebc23-ca9d-4a7a-88c6-3dec1536f109", "comment": "Malware payload (Dridex)", "value": "34fb80c341031d70107e75bfa2a4499da4eeac7df406b567dc94125a5ff43860", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846844, "uuid": "30b12330-5b4d-4d76-b34b-b5202e21e6fc", "comment": "Malware payload (Dridex)", "value": "c3e065d073c41036e310ed672ebf48e1dc868559", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846844, "uuid": "a44d2432-02b8-4627-b1f2-9f51bfc5bf3c", "comment": "Malware payload (Dridex)", "value": "fcd48aa0ed59296c204ba24f03541082dafeccd6873782b7bd322674c5d240fe0746f6d80e11d6b97dfa6b2e1ff71118", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846844, "uuid": "c3208aec-451d-4baf-ab98-764c50f2ba42", "value": "98F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846844, "uuid": "b4471579-39db-4513-95dc-3acaaca9c85f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846844, "uuid": "3bde4a5a-b604-477c-9f88-bcbd711c9673", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846844, "uuid": "107581ff-ae23-42a0-aa89-d5809d219d2e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846844, "uuid": "fe06fd75-ac0c-470f-a1b6-c5e615d8ef66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846844, "uuid": "d30b4daf-c87d-41a5-ac47-c36f6de6689c", "value": "4ff52791_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d5ca19-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821695, "uuid": "65e371a6-02d8-49e3-81b4-af21911c1d5c", "comment": "Malware payload (Dridex)", "value": "1cd2862fce77d3bfb6366d5f282159d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821695, "uuid": "2137535e-a271-47b1-9e18-14f13b7d8561", "comment": "Malware payload (Dridex)", "value": "351abde7f26eed5c80c795864cfc9909bf41ee44440d564e93f646a9238be234", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821695, "uuid": "ed90a588-d453-4e3c-ab62-9e7bc2db4888", "comment": "Malware payload (Dridex)", "value": "b544d2107958b75012f4d27adb5b928228e2080d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821695, "uuid": "6d94219d-ca8f-4c28-ac75-d0094cf6374c", "comment": "Malware payload (Dridex)", "value": "49347f4fb76f5b7b080a53aa2d944a6e86965390f81870d6490f69e925896f2c7f885d3b7400b99a05b050cde5f594f4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821695, "uuid": "67cd50f6-51b4-4533-a20f-c700520508bb", "value": "48F3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821695, "uuid": "d904a089-3ad7-4d74-90ce-5f5ce9943a10", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821695, "uuid": "98ed143b-8df2-4efa-947b-8c08159fe213", "value": "3072:ZiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:KeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821695, "uuid": "c5bb3b8b-affe-47cb-a41b-42650c6be3b5", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821695, "uuid": "a1015be9-1b21-4f3c-8c3c-a57f4d8255e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821695, "uuid": "f28fe3af-e042-4e59-aad7-3ba6681e6509", "value": "1cd2862f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9486f602-bcb6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621877792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621877792, "uuid": "3c050735-162b-4cdb-95a6-d8e1913a1d34", "comment": "Malware payload", "value": "123ca625c7d2338167f3cba08296014b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621877792, "uuid": "2398c3b0-79b9-439d-99f0-307bd86085ca", "comment": "Malware payload", "value": "359de4e28b1286f601c3d8cc5987ff8f81335f049411f00d99496c2f56bbade0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621877792, "uuid": "93d8494e-6810-4a89-8547-2d9116be503a", "comment": "Malware payload", "value": "483242dad8a784d2cde3a98ab7054efcd742bd0d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621877792, "uuid": "ebd54495-e2a2-4bb0-b745-a59777603f8e", "comment": "Malware payload", "value": "9aa8bac01da74e068b8257524e3268d53ecfb3f503d016fd824c0c08bdea49a1ac25a9e3f9c48e063ff018db3a25916e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621877792, "uuid": "75532c38-7028-4690-aae8-4243f19ade67", "value": "5663C7107394C526E07A9A728ED7D7DE3734FC50AD21872B31E9331F2D7A6909E26788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621877792, "uuid": "fc779b48-a981-4a36-9864-de3eac31ab75", "value": "384:s1R1zjSkFLvz/Nee4eH7uwnmWYTdPIclFo39D:cNeM7z6YuwnyT1Icjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621877792, "uuid": "9497e760-85ab-414e-932a-1ab9d7aea0e2", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621877792, "uuid": "38043293-e68c-47e4-b4be-1a29287d8bff", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621877792, "uuid": "cb37bb60-f4a2-4845-88fe-18476aabe669", "value": "SecuriteInfo.com.VBA.Logan.1399.19777.30889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f554fbc7-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621821691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821691, "uuid": "e54e779e-502f-4c23-a86a-b4a55acb9224", "comment": "Malware payload", "value": "f3954252c3d4509807322079e51886b4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821691, "uuid": "4ffc722d-3068-44b5-8762-33de8bc04d94", "comment": "Malware payload", "value": "35ac70e3f20ccce3df175ceae07addc1450e8343a292bfc2682a501980b656fc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821691, "uuid": "513f5be3-8e6a-4011-9b36-1dd1a576cde2", "comment": "Malware payload", "value": "e561dc735ecb5d35d6df6cb337c739eec1f6605a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821691, "uuid": "ed850acc-119c-4442-8cf4-32a0fc6a3ddb", "comment": "Malware payload", "value": "e723758863f6959de0bde0d3ee3e5e0c9cb3df888d1af1ba1ed0b9c06d68e1266ab171e64f384ac3ce805170cecf15a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821691, "uuid": "6b328ae6-7a2b-4c3f-abe4-e8aeba8fca72", "value": "D70412707CE5D8167F750A69B09093632BE723978D270FA9D386D8D472AA076C140EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821691, "uuid": "53c2a840-6bec-42e3-9d8c-703ecc505c3d", "value": "3072:R3dwdbzDSRzeriIHXKCojtv8c6SIUHITBasCFifaZxiXd49TNZ10OHi:R3dwdbz2deFHXdqv8c6SIUoTBXC0insz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821691, "uuid": "47be02ea-8ee2-4739-a53c-90a77c57a160", "value": 176453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821691, "uuid": "837b6033-0162-41fe-9e69-a26ccc410dcf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821691, "uuid": "b0adec7e-24e2-454d-9a99-41ebc8ce01ce", "value": "f3954252_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e13b709-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882908, "uuid": "9f30b00e-ff94-42d8-8bd6-0d6a460676be", "comment": "Malware payload (Dridex)", "value": "21428d962e7b82f838338807d41adde2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882908, "uuid": "ec5408fb-5f35-4703-b0ea-8a8d6a3ef391", "comment": "Malware payload (Dridex)", "value": "35ef450e42c0083f41ba4d92cc0642ce29bb67e918cad8d0a9fe7e7ddfedd25d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882908, "uuid": "48eae225-a6bb-49fd-aaed-a2a20dc95a8e", "comment": "Malware payload (Dridex)", "value": "03d14e67da0b711f7bea9d6fa056165cff65ee65", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882908, "uuid": "46182f3e-1f3e-449a-ad73-8c5f0a6875ae", "comment": "Malware payload (Dridex)", "value": "0918bbf1e60251687d319032bd2d750a2a9cb278ef0402bb3d2bf20fa274a1fb1b3fdfa7ad5bd8e6f646da051671494b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882908, "uuid": "3b9662a3-eaf6-4c35-ab0e-09d2643938db", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882908, "uuid": "d41cd1c0-8eea-44c9-9c93-474a12b0ddc1", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882908, "uuid": "e50b9e35-4936-4075-9832-0b130348f2b5", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882908, "uuid": "3876042f-5c3f-4564-be6b-31e9dbc25bf6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882908, "uuid": "9f48e096-ea5b-4af0-a573-4931298aa837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882908, "uuid": "121fc72e-0b55-41a5-92a3-a1a02ab8d953", "value": "21428d96_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39344fc7-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886658, "uuid": "3c04a2c4-1004-4059-a78b-7b934c086d58", "comment": "Malware payload (Dridex)", "value": "f00de22f9fec41142291e068afdd9cdf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886658, "uuid": "daabe579-2bd4-40b1-913e-b3144b8e416b", "comment": "Malware payload (Dridex)", "value": "361356b8aaf387cc3997892a69ed6d7b2cceb430c1c9ccc1b4ff50be6f074a13", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886658, "uuid": "0c14cbad-ff18-4bc8-aa8a-0672e342ac05", "comment": "Malware payload (Dridex)", "value": "91e833c15ca4c1dd45c486ee71bebf901d1f535d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886658, "uuid": "27cdd1e9-2edf-4a1b-8b9b-04c726475f03", "comment": "Malware payload (Dridex)", "value": "e322cc9caf49cc97df943eec266203f330cb8fcb81b44e85e654ad3886d2088e90babb178493c3a961e92c5b46801718", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886658, "uuid": "3f57d8b1-83bf-401e-b6fb-970fe1a272c8", "value": "26F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886658, "uuid": "98966aa0-f9c0-420c-85a2-253a72c0fadf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886658, "uuid": "3a3a3c53-9e3d-4fa1-b0f9-4e8fd69bc200", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886658, "uuid": "2cac34b8-0461-45f0-addd-9112c5c1f0d7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886658, "uuid": "a7805d83-e475-4c8b-9117-cac84fb8edbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886658, "uuid": "162aff14-c945-4d02-9cc3-d489ae9a15c2", "value": "f00de22f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2499ca6c-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886624, "uuid": "5505a9af-4ba0-41e5-a87a-573314955e7a", "comment": "Malware payload (Dridex)", "value": "1173ecd99f11573691f5d6bc3880bd92", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886624, "uuid": "3655407a-cfcc-4268-9e67-726da472ebbb", "comment": "Malware payload (Dridex)", "value": "3638a6f7c7f623f8589da9d8fc6da82cc5b9949cb18704e117ac2eb3ba94fae7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886624, "uuid": "97f49f4f-d033-4e50-9827-20461608238b", "comment": "Malware payload (Dridex)", "value": "cb7872483b4cb2ae9b3f680d54cb329b44e4d25a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886624, "uuid": "a5f73af2-34c9-49a4-a534-c8d3eafa379b", "comment": "Malware payload (Dridex)", "value": "32d23f1e516f8afc97f02c78b001182d0d06d6664c14d527df7b740334f3333870d1f4950e240db74b427035b07036e5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886624, "uuid": "0b9045cc-a003-4e05-838f-2678a0bcdae7", "value": "52F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886624, "uuid": "773b674c-c6f7-4557-8ee7-25d67563ab83", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886624, "uuid": "4cfa31fb-bdc5-4631-96d4-dd653549d6a0", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886624, "uuid": "a8e1dd3b-bb3c-4386-81e4-791daf232309", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886624, "uuid": "507c0fc4-3c07-40bb-a8b4-8433f664a1c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886624, "uuid": "661207bc-6213-4e36-931c-54957e465b30", "value": "1173ecd9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53142b55-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890138, "uuid": "b60ecea3-374d-4ff7-8e6c-fec7bd2aabd0", "comment": "Malware payload", "value": "84b26200adf38d91a174b72d2edf6d49", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890138, "uuid": "686de671-ec3c-4fee-bf86-4d3ba68034c0", "comment": "Malware payload", "value": "363d33da4ec9e76f9c2539596a3b3a5bdae5b0cd585d98d2e92318c0bc56cdbb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890138, "uuid": "52bbc197-3a9c-4ecf-a9e3-47378b6109df", "comment": "Malware payload", "value": "6b84bf5753e1fb2b6d325bdeb9ba80586a87ef7b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890138, "uuid": "38008994-b77d-4a35-a9c2-33f7bc6456d3", "comment": "Malware payload", "value": "0514658b6d04848356847997f9e6cff445e0f3d7644adb734f56929f48c81054603f9b52c11ba5b271eaebdf3fb34e08", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890138, "uuid": "24a871a9-a2a3-416b-989e-c446d07f704c", "value": "B9F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890138, "uuid": "9ff037bf-1d64-4859-b688-9f0550107a33", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890138, "uuid": "ce6a7042-45a1-4caf-a343-45a82b015c00", "value": "3072:WiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:NeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890138, "uuid": "daf699c2-271b-40c2-8068-c9d827f9b3c1", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890138, "uuid": "21a738b8-d9bb-4c6a-95e9-d03192ae94f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890138, "uuid": "7078e977-53a1-44b4-9ced-5d2c1ec2caf3", "value": "84b26200_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4944ea1-bca6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871055, "uuid": "03077525-fbc2-48b7-af4b-ef4b3d8776d7", "comment": "Malware payload (AgentTesla)", "value": "106c2e554bf1cbcd6b42d7e1347976cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871055, "uuid": "349547ba-2952-40b1-b6c7-f1ab3d5cf79a", "comment": "Malware payload (AgentTesla)", "value": "3660e5c8b93737203d8fd83e8bf059e2dedc8ca43e7cbf91e15f75df7ee4a1d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871055, "uuid": "eac2589e-6dc1-4f80-a812-091950428f2e", "comment": "Malware payload (AgentTesla)", "value": "fbc6c10f087ee2d003d1444a2c06cb9fa1fcb110", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871055, "uuid": "65b2490b-def6-47e5-870b-6122f3b8a22d", "comment": "Malware payload (AgentTesla)", "value": "d54eb9f3ba9d54b46686d13f6ed3a1c60b00c2045bb27e5c025918766634385bffebe34fe599b7d1352d92ac1ee09d1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871055, "uuid": "908ccb6a-7281-41c9-9708-3933f089536b", "value": "E115AD2C516EF126C2ACC37946D4443BE590D7377032FE28ECD757A85B29E80B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871055, "uuid": "fc1bcf2f-91be-41a9-b576-90b77fa0922b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871055, "uuid": "b4d2ad82-df4a-46a3-bfa5-ed863dfcbb3c", "value": "24576:pBC7DH6SWG4BmLgbIlpqxcG1RCRdKZX1C+pmW+tTV:pBC7DaSX+mqIlcWG14RdKZX1C+pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871055, "uuid": "12ad0731-4fc6-4ce8-992e-a026f5fe945c", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871055, "uuid": "54ecc3c0-5a61-4820-8ca4-8e1e93783ea9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871055, "uuid": "a35e2f99-0114-488e-8f1c-f784f9922674", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb8d128-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621861566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861566, "uuid": "d5800d58-45a3-4fcf-b3bc-0e20eea0de8c", "comment": "Malware payload (Formbook)", "value": "13023b4453e98378bf05047bd0bbb9f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861566, "uuid": "b9dece41-b23d-41ef-9965-03a5b93511a4", "comment": "Malware payload (Formbook)", "value": "36b5ddc5914b203b4213ad5cc15cc498ad16691d84fb239220331fc83503e76d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861566, "uuid": "78d288f6-1191-4484-9d0b-a6b24816ac12", "comment": "Malware payload (Formbook)", "value": "d0516cb3b74b9c36512957a36a8d00346de28160", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861566, "uuid": "2adef43d-8a81-4e18-8756-b37cfa642e05", "comment": "Malware payload (Formbook)", "value": "528020aff08e2c0a133b17297efd012e3fa2099eb0d995017779faf3c390c9d92f6a60f1aebf92c686607f0ac99f480f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861566, "uuid": "79fec2fd-34b0-4435-827b-5621becafb16", "value": "4794AE28B6A8C031E0BF12B459B5C2B865397DE16B3440FF62C53AEE52346E5AD3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861566, "uuid": "db35c8c4-f83d-4a4a-a98a-ffe3faa06396", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861566, "uuid": "14986d8d-10c3-4e26-be6d-156ab42954f6", "value": "6144:MKL0e5f1XMELk0YVYISuhA9VxoFVGMZud83+xcb88O5lDNNq992XsTRV:MKL0e5f1XxTYVdNA9/If6xllNc/2XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861566, "uuid": "aeb716e2-6372-4403-8a64-95f69a94003a", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861566, "uuid": "bf93d432-abef-4802-a04e-f43baab3fe63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861566, "uuid": "c30f24c5-6227-4cbc-9e89-e7face7cd406", "value": "SecuriteInfo.com.Trojan.GenericKDZ.75441.5474.28833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1c4117-bc4a-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1621831228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831228, "uuid": "b2db4af8-f408-48de-b87c-5aad382e3223", "comment": "Malware payload (OskiStealer)", "value": "04be40b66967aabd5dd5e9765f31cb25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831228, "uuid": "fd431a6b-3aa6-40e9-a59a-2bc516ef8ba7", "comment": "Malware payload (OskiStealer)", "value": "36cc9f47f3ab822654453805a7207df0411028948f0326e159491623d15be6e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831228, "uuid": "0d74cbeb-4f6c-438c-9af8-1896453be551", "comment": "Malware payload (OskiStealer)", "value": "6d5cf1c4d33bc41001363ed562270f1378ef1b7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621831228, "uuid": "fbd0c8ca-fb8f-4845-b7c7-e7ecb4d51d20", "comment": "Malware payload (OskiStealer)", "value": "7d368f3cd2a42dc097a0317cca99320e4926e784432e2f02e7cad54b84b958568bb51bc728060b870a0a4d70de9efe74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831228, "uuid": "d991fda0-b1b7-438b-b29b-075f5be55124", "value": "92C1C40467DC433AE9B3CFBD68F7D3561038B7014E679B0C61D4422EAC26245EF22BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831228, "uuid": "0d3029a2-39b1-422e-99f7-4d4deafbddc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831228, "uuid": "2b922feb-8462-4225-bbee-2d5e6508616e", "value": "48:6prMhgq2/MxkUnPymtUdsFJLxZQbsKHrwaaO51+n1SmDqBHK8KzWyzlW9AckuA6z:h2/MxHKmtzZQb1VjKbDkkpz7rzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621831228, "uuid": "80a0591b-f08f-4e57-afed-387bec2fdca9", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621831228, "uuid": "a41bccec-de6e-44e8-94a2-754686f80e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621831228, "uuid": "097389e3-ad6f-4d51-a7ce-8cfbc4e9442e", "value": "Shipping DetailsPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e032f05-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1621843395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843395, "uuid": "793db365-1b00-40bb-8c5d-b79ee2d258a4", "comment": "Malware payload (DanaBot)", "value": "96c614ab093dfd151fad5d1e86be6c78", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843395, "uuid": "a83d3a19-2f6f-40a6-b9a0-40757e236608", "comment": "Malware payload (DanaBot)", "value": "37ac55376fbefed78ed34839833e8c8aa50aff9f8ae47cc70317e502c8e961f2", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843395, "uuid": "d8651a02-a681-43bd-bd2e-aacc1ad3ff3f", "comment": "Malware payload (DanaBot)", "value": "b28028e1a373ee3bd7052db68a9e0d1139239bfc", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843395, "uuid": "d062c151-0129-434c-a6c3-380303895417", "comment": "Malware payload (DanaBot)", "value": "806aeaa5c57f637d5fcf5134aa362d05ad1f26b282c786b0cc53fed79d48579841deff61b0ee4ff4b60cf3e97d7b0b96", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843395, "uuid": "84848ca7-6c6f-4569-b934-b186eb6e5ba2", "value": "CD563341AAB0C0B0F9B726704AB591A9796FBCF4671082DF62D13DEF52764E16C3138B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843395, "uuid": "5c3c8947-0131-4796-a684-e9a880851c89", "value": "c1547c738f79c15afc554fcab1eba054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843395, "uuid": "737e6b87-3a43-494d-9bb1-6078230d7a39", "value": "196608:P8dLmWS/8EongRvK/fSpGNXUOpYy1VC/Vy1G:0oWy6/qE+ny1VCNyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843395, "uuid": "b7057b16-d1bd-4b2f-921c-dda1d9002ca5", "value": 6326784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843395, "uuid": "61e4a78c-377a-436b-b9aa-ecfc16938b46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843395, "uuid": "4ec66a9a-876c-4553-b962-d67d7421b9f7", "value": "96c614ab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f63fc95-bcb3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621876388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876388, "uuid": "bc081a99-f2ee-471b-92a3-5f333d8bb3a0", "comment": "Malware payload (AgentTesla)", "value": "370ab95039316d69cdaefc0271d4f041", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876388, "uuid": "a61cc104-556e-48bc-a2f0-b75994c7a818", "comment": "Malware payload (AgentTesla)", "value": "37bdae78da40f9492cf5d6d4271d688c1a8f2701cd087264a702a847170568b8", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876388, "uuid": "c2c5cbda-535f-40d9-b03b-5d0af0567dd3", "comment": "Malware payload (AgentTesla)", "value": "9e43578a0f0e9bad36b9947d9fc9c512aa7d48ca", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876388, "uuid": "f6323f15-9fdb-48ea-bac3-0c30d325fbb8", "comment": "Malware payload (AgentTesla)", "value": "40122e9afc41ba46810c885b78be558dcf6050370a2dec3ac1b8e6b84076680644fc7509633227d093fb6f0dbce3c1dd", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876388, "uuid": "9af8383d-0f10-4f72-b0b8-6b303e10ffb9", "value": "60E4E123B6E062D9C6799674ED25EA7063132EA46440F66FB2D4FCDB397D3330466883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876388, "uuid": "f1e2f02d-7e42-4b6c-b3a8-7680780c44e8", "value": "12288:kg3yiWa4Uo56pgxDwjcz2K9PPU91xvDvUOL+nzg++++4+++++++0+++++++:53yiWa4z5IgxDCi2K9HUNjA8++++4++4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876388, "uuid": "2cbdb4f9-b6c1-4f9d-b3cf-952a0060d235", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876388, "uuid": "3a08f969-51e4-4258-bdb7-d659d9e31104", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876388, "uuid": "c8ffed0a-ca27-4292-9b0b-a1b84350c19c", "value": "Blanket order 20210423001.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765271a8-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872158, "uuid": "e1309f11-321d-457c-957a-b1c9e1dbaa6f", "comment": "Malware payload (Dridex)", "value": "aa9356e092cefc0cb2cf8f85795d94e4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872158, "uuid": "3a39835e-1b35-41c4-b964-205bbd9859f1", "comment": "Malware payload (Dridex)", "value": "37d721b70400f5382fad7799ac869b7d9f3fcfda13c93bc52c41de1938971410", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872158, "uuid": "ebc319ed-d2cd-4ea4-9876-af9b5d6d38be", "comment": "Malware payload (Dridex)", "value": "7790b1fef17ecbd564e35a0bf597067b11d2fe2c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872158, "uuid": "861ba170-14dc-4f4f-98d5-791633390a9a", "comment": "Malware payload (Dridex)", "value": "ed3624e995fe13fc45450b16e1b0846f4eb6fca28048b90282f10d693b2bda415928a25cd34f68dfa4f34ecc32565302", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872158, "uuid": "f059ca82-f536-4587-8e4b-91f18aded16f", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872158, "uuid": "a3fc0c2d-dc82-476c-8d5b-310f180bdbc8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872158, "uuid": "4531cfc2-5241-462c-bf55-7563c5d4221b", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872158, "uuid": "3c864af0-d424-4cff-b218-1967bf86b146", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872158, "uuid": "aa5d1cbd-c42c-42ba-8b56-98672de6eb0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872158, "uuid": "e3250557-64f2-40cf-8980-dd29df87c497", "value": "aa9356e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf7ad83-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872062, "uuid": "34d0e132-822a-4f31-a0d0-f4d8258fad3b", "comment": "Malware payload (Dridex)", "value": "ec37e217f3523968cea4df678f5a4a8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872062, "uuid": "cfeb372f-ff63-40bb-826f-746bbedbf9a4", "comment": "Malware payload (Dridex)", "value": "3821fe0662464d379a74064f95ee91c7b460797704ef4f770748d34950bd65dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872062, "uuid": "777675ee-e887-4b69-983d-177f173503a6", "comment": "Malware payload (Dridex)", "value": "5e84e3acf7b9752d4bf747703c75188ae226b18c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872062, "uuid": "038f9f11-ddc6-4359-a004-67b847e32cca", "comment": "Malware payload (Dridex)", "value": "62693d8ddf0ea56fc0cf88278057e67175cbf137f8d2c6f44f24b4da9f5c62465d58d99b1d509721b7f0def958fc6cb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872062, "uuid": "48595781-98b0-44a7-a10b-8d505a5aa054", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872062, "uuid": "bceaf7ea-7bea-42dd-b2d4-cacaf7ceef1b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872062, "uuid": "f7bba05c-6bff-4b31-9448-70f82f40adaa", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872062, "uuid": "b531909e-3f50-4b19-a37a-5ed383da54d6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872062, "uuid": "494d8cb4-ed89-4682-97ad-996c6fceb8f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872062, "uuid": "30a42f3b-132b-4298-b605-f9155a524a77", "value": "ec37e217_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7270dc-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893673, "uuid": "aea68cb9-9969-4cc6-ad48-3e77b6fd9eed", "comment": "Malware payload", "value": "a9b9b70ed6504cb697a505c79659e5b5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893673, "uuid": "b4478d9c-c192-4d1d-b7b7-37a9816caf13", "comment": "Malware payload", "value": "38906eae43555be845d8a65fe8136946651e9e1d80745912338fcc53dba60420", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893673, "uuid": "d9b7dae0-012f-4258-8e8e-40b92fefd69c", "comment": "Malware payload", "value": "6f5e3ea411e5b651c11d22323ad534f72fe055ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893673, "uuid": "da132fa5-cbc5-4bfb-90ee-02a62fb78496", "comment": "Malware payload", "value": "81a79c89c902b7d09b46ff9691e7d4ff6753d60e79a316684ae0191bafc2c141aedee6526e23bb4d9c929ed23698068e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893673, "uuid": "35e6f0f7-2650-494d-a8b6-58639586de96", "value": "E6F3D088CBB3E4E6EFB3D37866F85E1B461574551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893673, "uuid": "72e6eaeb-4812-4eb1-8dd2-62fa71b56b94", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893673, "uuid": "78474a19-f3e6-4be7-b992-51b914a34f76", "value": "3072:dmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893673, "uuid": "6f49eb2b-0281-459c-a4fc-5fc25719d342", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893673, "uuid": "2428dfaa-3ec8-4ae7-82e6-38a9d372ed33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893673, "uuid": "b3af7940-34a1-4cc3-a0e7-6f188ee59fa2", "value": "a9b9b70e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4224a47f-bcaf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621874647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874647, "uuid": "85ef4fe6-1c6c-4d47-bd55-bf03d8004c2a", "comment": "Malware payload", "value": "23248a0c45bfe22ecf3e9de08d834828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874647, "uuid": "68b3c3a9-b5bd-4912-ad13-f1887bfedd2b", "comment": "Malware payload", "value": "389d3e614aa7a8123cd910221b23192442ebdff17d82cf74b57def62a296f71e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874647, "uuid": "69bea257-6b9d-48e6-9df6-0de627eb28be", "comment": "Malware payload", "value": "3df2429e30691519d5135a45e0caca38b14e169a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874647, "uuid": "81fbe198-3e15-4465-8fda-e8acdd8778be", "comment": "Malware payload", "value": "bbb6bb6eb188b2dc48fa114d4a18ecc929b93eefad38891eeb673e334d7f86a01e65092913febcc95cb18823084dfd13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874647, "uuid": "97bdd9fc-e1f3-4fc7-8324-619b9fbea861", "value": "A634C513E610F10EE993C1B12D28969E682A2E3506C0AE17B7C56F5E35726D3B8F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874647, "uuid": "a0398c5f-ec9c-4b6c-b18a-d0d99948ce48", "value": "7b8bcfd7b99728418ba315f20c4f6aa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874647, "uuid": "17254256-09e9-40d7-b71f-cc2e52b1a34a", "value": "6144:mSwhBW1HPZlLrEjhMzVwr6VBF7tXh63isWipwS:/ok1HLr95tRSijdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621874647, "uuid": "95bd4000-2d58-491a-86b8-488cb668755f", "value": 245107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621874647, "uuid": "b68eeb84-36f7-4109-90d1-31ef46c752f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874647, "uuid": "fbd75a2c-5993-4729-8fac-36347c4ac6bb", "value": "image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c1d22b-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836032, "uuid": "c3975877-b79d-4ab4-8c19-57a3fe9b1846", "comment": "Malware payload (Dridex)", "value": "f3cbd8f926e2a408917be46d0d3d346b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836032, "uuid": "88553812-85e4-4034-b57b-b683f71bdba7", "comment": "Malware payload (Dridex)", "value": "3935cbb07172e6ea8164a8ecfe0f375b4830632679b8e7f8c2e531d80e1b4472", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836032, "uuid": "e1b223e8-4395-4666-b5c0-37d342a38cd8", "comment": "Malware payload (Dridex)", "value": "00e861503c81825209671c53bcef2159a73894a2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836032, "uuid": "d8177cdd-e31e-4202-8296-798a4a901f8f", "comment": "Malware payload (Dridex)", "value": "19d4cf1b8bbec6257e1e0d9b269ad2cf6ff714750786094c3493f5f68e7bfba451d5b8f2999ff99ef510e73b105ab470", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836032, "uuid": "db59b110-dd0f-4801-b5ca-602cffea8f6a", "value": "B1F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836032, "uuid": "4e624631-6d1f-4cc0-838b-d247bbf7cf18", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836032, "uuid": "c10ebc1c-efb1-4a53-ac4b-7e3a06e0c5e9", "value": "3072:7iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:YeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836032, "uuid": "ed590ce2-91cb-45c3-964c-3e14e2a43471", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836032, "uuid": "ef7d2c79-5fd1-4b9d-8525-c2c782073346", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836032, "uuid": "3c96c404-691d-4d1c-8d20-949ba1e0fbe5", "value": "f3cbd8f9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91d0b7e-bca3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621869693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869693, "uuid": "bf0c539c-2ac6-4dcc-8ff1-25e356d1c37b", "comment": "Malware payload (SnakeKeylogger)", "value": "7a66a97b1c85e4e0a3b41afcab017004", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869693, "uuid": "bc31f5fa-b58b-4f52-8cbc-92bdb9ed020c", "comment": "Malware payload (SnakeKeylogger)", "value": "39927ae61506aa5843d1c0a3c59326056718824ea64eaf0399c04c3f431cf7e6", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869693, "uuid": "cf979db5-6f36-4a14-89f2-8732893cf50a", "comment": "Malware payload (SnakeKeylogger)", "value": "b3436e9704c48d4e1df3fe7a6b55d3d7e190a4ca", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869693, "uuid": "05de3379-ffb5-4650-9770-c9d66889657d", "comment": "Malware payload (SnakeKeylogger)", "value": "1d391a9d8fe34e6469fdcb41c0194a4dc9dd210eee5f3e7ef01aef2ad8523efc875a89c96584e23839e90d775f5588dd", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869693, "uuid": "cbf4f8c6-5732-40b6-9113-b731ac19b18e", "value": "02F4332257DC537BDB9F35CA77EAC1C40881608EE8C2C2AADB590E5F71022D3F60AD95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869693, "uuid": "c1fd6306-fd56-4971-9452-be274e76e7c5", "value": "12288:tE9B0Bymko9L8BC4l9Hy+PSWxfQYEwX2g3YYPgLHMh4uyeCYyzYSEtiI:tEydj9QBC49PxIYjH3/PgiJyeCSSEtiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621869693, "uuid": "cd25fee1-dd41-4c9b-966a-fe81241ed7b6", "value": 746626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621869693, "uuid": "13957c60-37d2-4c60-bc83-8cff11b136e9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869693, "uuid": "78dbfd56-f272-4185-8dee-fd1e4ef0284a", "value": "New Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f08f18-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861373, "uuid": "0d5ee4f8-ec22-47cb-8680-c1d003b2201d", "comment": "Malware payload (Dridex)", "value": "b055cfc29a0780a23a141b1cd72d643e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861373, "uuid": "f6fc1bc8-586a-45aa-a379-c5815f5cba3f", "comment": "Malware payload (Dridex)", "value": "3996766ce61d36fc691cf135424d888d38950630ea592eaabd247735ec9652c2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861373, "uuid": "23635bfe-758c-481d-9ed1-7eec47251905", "comment": "Malware payload (Dridex)", "value": "a5bd9631cc069eb68e8c7265183ba5022e3aa24f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861373, "uuid": "86f92d0a-7d29-4c66-b060-24035eff9323", "comment": "Malware payload (Dridex)", "value": "43f4e9f5bbee673393115826c5580a9182c60cc8886de6fdc9b244acd5f28c9a7eb9a0261393a28cf78c48cba4781b5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861373, "uuid": "f863bbb0-96dc-4a70-85f8-57466aa658eb", "value": "62F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861373, "uuid": "d09007c1-3083-4270-833a-5b3684c0c9c3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861373, "uuid": "abf276a0-4741-4774-a333-61b2db1be0d9", "value": "3072:NiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:WeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861373, "uuid": "e832521c-20d1-458a-8a58-df010368f08a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861373, "uuid": "59a6c44a-2dd9-4c6d-8e0f-4c6bf873b686", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861373, "uuid": "9b4f7b83-c466-42ff-8b0f-84da81537592", "value": "b055cfc2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32465d4-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821633, "uuid": "afb7fd7e-30e5-4c6b-ac4c-56181e89d8f9", "comment": "Malware payload (Dridex)", "value": "8b2d97e0c38880f571442fa7590a8fdd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821633, "uuid": "f7e5af06-4c77-4c47-a19a-739d507ef158", "comment": "Malware payload (Dridex)", "value": "3a5e33610bbf4988b97655170d66ecff0ef5bee4ae282b09092476dd8320008d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821633, "uuid": "0097df30-8f86-4da6-a909-8a53ba4c880d", "comment": "Malware payload (Dridex)", "value": "e3800c96b7d5c7684269afdc1ac97b43f9ab7c3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821633, "uuid": "d238fac9-1f59-4b1e-8c5b-28bb62b05180", "comment": "Malware payload (Dridex)", "value": "c26ca4e3371c9d184c89ca65749004deab2ca7081ff2463985e4f8265de9dda9b15641be29eea329b6c131f941e19ee7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821633, "uuid": "0dbdc2c5-3bb2-47a0-8d0f-d2dad3a6a465", "value": "44F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821633, "uuid": "6c46ee1d-4cb9-4b47-85fc-4a08a4f71f8a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821633, "uuid": "8b5e00e1-d772-488a-9ee7-a9446202f033", "value": "3072:WmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:HLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821633, "uuid": "9ed852fd-19d7-41ce-8dc7-28315679f76f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821633, "uuid": "4d2c862c-2156-4ce5-83fc-97069e0b4c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821633, "uuid": "3df194aa-2d29-457b-ad3f-2ddcf0976038", "value": "8b2d97e0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c363dbaa-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846947, "uuid": "bf206478-53c0-41fb-a600-5a1ed424df97", "comment": "Malware payload (Dridex)", "value": "9840af3d3753e24d8d0916c1c12474c3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846947, "uuid": "69e4f143-63e7-44c7-9d54-e9d6d070fa3a", "comment": "Malware payload (Dridex)", "value": "3b4d3275ab536c326cd7d502f49c68f8432ff36e856cde8b6943849884973172", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846947, "uuid": "810e60b8-fa69-40cc-a5c0-b42c823b6c79", "comment": "Malware payload (Dridex)", "value": "d0ffb6b8d45e38fd4f914ab863ddb78bd906d09c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846947, "uuid": "c39d5d74-d59a-4d6a-b149-0cd81f8950c8", "comment": "Malware payload (Dridex)", "value": "57229a0fe2a66c07d16177955c8f85658bbae0741180813f785c42edb03fbec36ab066ae412ccf6c8e72ecdf74e878cd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846947, "uuid": "6e89af25-4a5a-4c77-a427-9ea50dd89aec", "value": "DDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846947, "uuid": "7986c5a3-b383-41ef-a478-864febbc9a55", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846947, "uuid": "3fa7d13c-5704-49c4-a3c8-0615812e1566", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846947, "uuid": "ebe9d4ac-ca38-4b6e-b93a-b93036b496aa", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846947, "uuid": "1a55543a-26e5-495e-99e1-cddd9a54f468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846947, "uuid": "6035dc9a-5f7f-45f9-93e8-6d5350d57000", "value": "9840af3d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fca3ac7-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839854, "uuid": "fc9febf8-6a98-40a5-a85c-143a2e49724c", "comment": "Malware payload (Dridex)", "value": "e1d15ea43c4f16b2103de48ff7ec810d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839854, "uuid": "5af67d10-c283-43be-805d-777df109cdb9", "comment": "Malware payload (Dridex)", "value": "3b793d8b2a2f5939f6e41483f46dd4ff1002c281c989e00193d0aabdf162dd41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839854, "uuid": "28a4a7d4-d131-44b3-a86e-ad96bd498e43", "comment": "Malware payload (Dridex)", "value": "9b427827b4c22c00f91ef1a736ea64ac6a9bffc9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839854, "uuid": "56ffb786-f94f-40d9-9d00-d6dc16ce6757", "comment": "Malware payload (Dridex)", "value": "71413ab1dd7e686f662f4d87adf5f1da1c1af38957e1a04f23b221846a82f0bc4a76653ae3e731d358a6e1b6e55f7d99", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839854, "uuid": "00e618a3-b44b-49cd-b700-8f2476f152eb", "value": "E5F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839854, "uuid": "34dac63a-c1e1-4bdf-86b5-1eaea94f60c8", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839854, "uuid": "a07946e7-5a08-4f1f-8c2f-97cca47b5884", "value": "3072:GA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:G3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839854, "uuid": "d1f5ecb5-1fcc-4130-927c-5c6d11515e43", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839854, "uuid": "c2a43a40-b7b9-4c55-94b4-6b3db4a1f703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839854, "uuid": "03eb131a-c3aa-4267-b9d7-3268171c232e", "value": "e1d15ea4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7ec88a-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850452, "uuid": "3f0a2855-b725-4328-9aaa-6c3579aae19b", "comment": "Malware payload (Dridex)", "value": "2a5054d51a8aa36c8178a4fbbf92cf9e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850452, "uuid": "76429511-ee4d-4f95-86ab-951b7111d86f", "comment": "Malware payload (Dridex)", "value": "3c028e7f17eb83422c5999991cd3617fd15de355de6e6f2a4eec4103c11e2148", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850452, "uuid": "3197006d-8d17-4ef8-a2f0-8dacf6b918ed", "comment": "Malware payload (Dridex)", "value": "fe52ae854130e5febe76b05fee8425a9a6b60271", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850452, "uuid": "b3d06734-9d81-4367-93e2-a341ad83c204", "comment": "Malware payload (Dridex)", "value": "4b298676e46bf45d7b143271e9be81d6481b262a9354e98ce2067f5993aace32d908d896a468437e6f957f5723757cb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850452, "uuid": "ff57d617-c536-47dc-ad8f-d9731ed0df18", "value": "50F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850452, "uuid": "e1e05b29-d7be-45c0-9dcd-333b3982eb54", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850452, "uuid": "c7181aad-bde4-4040-a4a4-bc87fd488fb5", "value": "3072:diFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:meAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850452, "uuid": "df194845-3b37-4cc3-bb1a-755c5ed23d72", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850452, "uuid": "2ba4e5b2-924a-4507-a1e1-7e1a188c004c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850452, "uuid": "ed57b785-99c4-4046-86a4-e9ce00b5be06", "value": "2a5054d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20b8594-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897276, "uuid": "ae0cf4cc-cbf6-4a01-87d1-dcd3fe8f5aaf", "comment": "Malware payload", "value": "0c6963a8381200dfa112581768694cfb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897276, "uuid": "18d475d7-057c-4d22-b21e-957cd411935a", "comment": "Malware payload", "value": "3c85eb1858c2c261a42a105f9240a1e6ab53ed1d8aba8f7a63a9ba84e59053af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897276, "uuid": "07410820-1618-4420-9e8f-b172452f0442", "comment": "Malware payload", "value": "a0093b18befddd43d3ad9ec82be3bf3edd2a6c90", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897276, "uuid": "8731b356-3fd6-47d1-9da1-75e2754b26b7", "comment": "Malware payload", "value": "4dda55e8e26bbe3bc32f7bc879345d70afb6895ddcd0c8f6ecadf0775141d5921e614581fea1082d5fdc5c4ef5685e9d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897276, "uuid": "59cc0364-76e7-4c37-91c6-8b4791f006e7", "value": "0BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897276, "uuid": "d38a2522-cc5f-480a-bba8-70aa2e7cdc6b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897276, "uuid": "5f94072e-c7f6-44c5-a376-a9c6f7655843", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897276, "uuid": "66535968-b6ab-4a4f-af42-9c28185b97af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897276, "uuid": "3b4fcd7d-a630-419f-a501-38f5626f710d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897276, "uuid": "dbe7539f-dcd4-41cd-a9dc-b4d14d5823e6", "value": "0c6963a8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e56a16-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875702, "uuid": "13b013f2-93b2-4aab-9bfe-82a1c898095d", "comment": "Malware payload (Dridex)", "value": "d63c27ede0b6c6ca69eb46adfd5fee10", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875702, "uuid": "6a28107e-9108-43b9-ae00-d686a289864e", "comment": "Malware payload (Dridex)", "value": "3cb39a51e6bdd337148ac89e8086df3bfdeb01ba104ba32d6330a196227cc840", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875702, "uuid": "4fa49d2c-4a8e-4057-9c5e-3ba320e79890", "comment": "Malware payload (Dridex)", "value": "774078a30e0e60f545939976bb5ac46ebbee865b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875702, "uuid": "83055b54-e7db-44d8-934e-b8d433d83889", "comment": "Malware payload (Dridex)", "value": "b8a4f864c5d74a8a96e16280728abd7a5ee84e3ec8127ee3ff1871c8cfb84bc7249b9b68dcfc2651e8ab95a6c1faa925", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875702, "uuid": "a70c8239-ceb3-4d1c-b309-02e008363ad2", "value": "CAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875702, "uuid": "60c689b6-913e-4173-bfd6-a05a7695855a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875702, "uuid": "cf9d7f4e-e78f-429b-953e-7b36de4419af", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875702, "uuid": "1e33b27e-3171-4c2c-ac7f-95dba93d72be", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875702, "uuid": "35eec751-e35b-4e1e-9893-f5301dac1c45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875702, "uuid": "fbce39c7-c629-4024-a265-138ad32d32cc", "value": "d63c27ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3d54d7-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872304, "uuid": "956622ac-3883-43ff-915a-c14a21a4ca32", "comment": "Malware payload (AgentTesla)", "value": "1a8b9513677279345547c7505626b8b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872304, "uuid": "3b694470-a109-4f3e-82d1-b39847fbcd1b", "comment": "Malware payload (AgentTesla)", "value": "3d9259db1b187202312ae5075e7b6b396ee38a61899d1980ddd8d673e6be00b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872304, "uuid": "0f3f4b46-b59d-4ebc-a9d8-a80cb5b506c7", "comment": "Malware payload (AgentTesla)", "value": "45c40386448e366d910b0edf759e7d8be7507f2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872304, "uuid": "2c3a5826-2202-4fba-817f-547faf226162", "comment": "Malware payload (AgentTesla)", "value": "0106aea321102458de60bb78f5944e96b06fbb6ce83c686e614cb80daede7794dc58d9722b21a6edaec46eb6f519cf7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872304, "uuid": "a87e3461-679c-477e-8b53-758a536e6c20", "value": "BF84CF3C58103EA6D1A3C6BE8CC1F59BE5A0932670300BDC5B97F337659722A78E54AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872304, "uuid": "559e2a4d-d187-4d22-bee9-eded0eaf2e0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872304, "uuid": "0268b358-9717-4963-b625-19707d301743", "value": "6144:LkyXQhf/888tFyBtB6Ux3pfiDlQfJaBmcFAlQImZB+grQIvc7n8dQSOALR3bAIAq:9Tqtlu9FgZNt3UUDR6TR/BeCYATzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872304, "uuid": "820edc84-8dd7-48f3-8fbc-dc7f5918eece", "value": 375120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872304, "uuid": "f8b8af5d-12ed-4f5c-9227-b633533d7bbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872304, "uuid": "25a76816-ed38-44e4-aa4d-650fb5f4215d", "value": "ORDER#14881 LP52476-81 SSZH7029947 SHURE Operations Suzhou.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19caad94-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890042, "uuid": "713d572a-1a5d-4dcb-ad69-4ac566c7e474", "comment": "Malware payload", "value": "424467501c06035c48f0540080922047", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890042, "uuid": "67a42624-a41d-4acc-8574-825c83292e18", "comment": "Malware payload", "value": "3da1aa2d60e5d91f9ce49317f4711be7945c9de00702e646debbc9046323a776", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890042, "uuid": "39bcfd40-0ba7-454b-b2e9-242267e0c745", "comment": "Malware payload", "value": "e8275eb030458db340d73ab3e8522c23f649018c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890042, "uuid": "71c619a0-34f8-4569-9d68-a9baa597461c", "comment": "Malware payload", "value": "c217a26fb842d3bf7fce7b1b4f8c8c67ced5faa61bf04f33c8769578a64a25ef214ef5c8c7d8f6babab458d783f4f503", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890042, "uuid": "f33bf96a-64eb-4a10-9b95-d0783803b372", "value": "B4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890042, "uuid": "399ce899-ee7f-41a3-b463-e0e095d75317", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890042, "uuid": "5af520d5-6aaa-4450-977d-012ef226f0b9", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890042, "uuid": "3286a88f-1f1b-4c2b-a6ba-5048caf71eb8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890042, "uuid": "65e25735-9074-466f-bf6a-88b205f5c338", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890042, "uuid": "1a3de5b8-f9fe-4cda-aaa8-5dfb3eab769d", "value": "42446750_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e04118-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621867386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867386, "uuid": "1bef8187-6d1d-4730-a509-a13bcade2c3d", "comment": "Malware payload (AgentTesla)", "value": "9133454ff4f84208d6d63cb70f8078e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867386, "uuid": "e735dcfa-559e-4e21-9c46-baffca08af47", "comment": "Malware payload (AgentTesla)", "value": "3db127d19f590705a17366ef32a1869c3c3f5489d01f60e5e99ff5eb7da7071e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867386, "uuid": "76412a78-7c37-44b4-b845-01b91730e85f", "comment": "Malware payload (AgentTesla)", "value": "4746e981d6d95f747c78c5de31d5acce59b48d4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867386, "uuid": "b70186d8-ee50-4396-8ff9-6c27c583bfc7", "comment": "Malware payload (AgentTesla)", "value": "9e244195a3560bea5dbaf6780bd9098e1ec2d7e2f758bb0659860d549536813d1bb6e364b0cf2df7ad21e4c1796174a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867386, "uuid": "c4079451-f6de-41e9-b1f8-a6756a2a8630", "value": "1AC4020472E86717E4BE4BF39471208417B9B49B5926E64C8DC820EB2E77F934B15FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867386, "uuid": "f102cf24-2531-4fd4-90fa-dad799a85dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867386, "uuid": "8403c80b-a95b-44d1-adca-aea5d14da327", "value": "12288:Q/cmUoHwjJAZq/kFcWtrg9eTjGRWBymv9RlL:rmUmgJAA/kFcMrWeTCsgmv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867386, "uuid": "5ab58fea-6629-41ae-be6e-8668f317155c", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867386, "uuid": "edbd2317-1561-4e26-b392-ecb69398ff61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867386, "uuid": "07531e1b-6e94-4374-906b-fb50121412ce", "value": "AMDPI 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88271720-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621876053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876053, "uuid": "81d25a56-6b84-408b-a1c7-56ee22628787", "comment": "Malware payload (Dridex)", "value": "140b5fb6f631521b88c3dc01e8612f44", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876053, "uuid": "80ddc3c0-12f7-4945-9174-5862d1c41832", "comment": "Malware payload (Dridex)", "value": "3db4837ec3d98a735ad4ed1357807c72047ce9f55ef432ee7a4f1a124ef4c727", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876053, "uuid": "5d6596ed-c973-44ea-92bf-c670178cc950", "comment": "Malware payload (Dridex)", "value": "c160de16bc720e6e43d963d8e0a902156c5a2cc2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876053, "uuid": "0fe50d92-6ffa-42b3-bca8-dfddc0642912", "comment": "Malware payload (Dridex)", "value": "5a3bf89d8f36b80c080cc1446c2db8368d5967aa823a9e0cbc7d541044f4c31796793d6834c1d674e9c02d35d8965416", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876053, "uuid": "0c2d0e14-1323-42c5-a0a2-266a7602016b", "value": "ECF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876053, "uuid": "74e308de-c27f-43c3-90bd-17ae0bf64869", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876053, "uuid": "aa3002be-cb06-4db5-92e4-8960b718f559", "value": "3072:hiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:yeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876053, "uuid": "adf72be7-6d98-44e4-bc24-b476263d3cad", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876053, "uuid": "bfacce67-68e4-4749-bc78-8dc4ccab81b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876053, "uuid": "9a862503-fbc7-42d1-a496-3551d7a76831", "value": "140b5fb6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df330f6-bc44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621828845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828845, "uuid": "01f63a38-0a66-43d4-8805-3668d65085da", "comment": "Malware payload (Dridex)", "value": "f518a62a641306c45cc55c5230b1ccdd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828845, "uuid": "12dc6658-eee7-4f36-9f62-239c3f0f4d0f", "comment": "Malware payload (Dridex)", "value": "3e14de4c9eaa56284ffa0fca0b8262f3412d40568700d3162ff22d2a8bd84654", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828845, "uuid": "9eb5ef6d-2c75-4536-aa91-91f544501cb2", "comment": "Malware payload (Dridex)", "value": "726f2c93eee6637bfd5397d82dc2c10c7c8ebf93", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828845, "uuid": "ec29c306-b22e-40b0-bbf6-2dd6d1892708", "comment": "Malware payload (Dridex)", "value": "7cb5ed2b9bb4954d6de090783492e28a1ce93dbeb7f485180947caa8966608e4fb150290cf6600c1d122fab88b3969f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828845, "uuid": "cad80c7b-b1ba-44f7-8846-475f02a9b728", "value": "0EF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828845, "uuid": "933c28b0-28c7-4223-91d1-ef465262d98e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828845, "uuid": "8e910446-13a7-47df-b0c6-3a6ffa0c9f46", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621828845, "uuid": "6f3da2ba-b570-46b1-83e9-208e5565a84d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621828845, "uuid": "e145d212-9fd7-442c-984f-f2a2b375d634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828845, "uuid": "2258643a-d078-4e69-bed3-d88fb075403c", "value": "f518a62a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab576f3-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864864, "uuid": "9b319507-ee30-4285-9051-9d370d6324b2", "comment": "Malware payload (Dridex)", "value": "73cb6b1646944f1e3cb518a6fcf5da13", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864864, "uuid": "ec7c9a04-083f-4d60-a747-4884152fea47", "comment": "Malware payload (Dridex)", "value": "3e2f8906b050f5161eca7ee5b2e1fa6bdd253559607af54510a5f029c292d684", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864864, "uuid": "1fc2593c-8dc6-4d70-a8ba-05c7508e6696", "comment": "Malware payload (Dridex)", "value": "3623c68977f7ac6cacad59022f2d102356a95609", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864864, "uuid": "33a011bd-9db3-47fe-a0df-b0aefe42566b", "comment": "Malware payload (Dridex)", "value": "a7898c6af76c55391dd59d646b1b0cf9c8afd8417f28d869a7e20956dccfe6f0d37e11f97f0763dcfb8dd6a65fe357fa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864864, "uuid": "932fd1a6-d906-4dc2-b933-cee419d7ab67", "value": "7CF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864864, "uuid": "a46a78e9-3c28-4803-9b83-602b35013bd1", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864864, "uuid": "654c4d36-c05e-4886-9f21-bf8bbc8a9fd5", "value": "3072:2lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:2lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864864, "uuid": "4b5c6c80-c097-42e8-857b-96758a010db9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864864, "uuid": "378ed3c3-c66d-4c3b-a862-89670572df7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864864, "uuid": "eace99ae-83fc-4fce-a255-a63bab886228", "value": "73cb6b16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17130455-bc69-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621844510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844510, "uuid": "48c084da-6e9b-4886-ad3e-56bf0651fbc2", "comment": "Malware payload", "value": "c36125f4f1200796d4bee560632ee934", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844510, "uuid": "66020929-b3b9-4a53-a252-278e8598b369", "comment": "Malware payload", "value": "3e6c2d46092e66790ace94f889c8c49d29e2bf7bedefe878793dd98b9b2c7b6d", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844510, "uuid": "0bd7ff27-78cf-458f-b352-2412820b9141", "comment": "Malware payload", "value": "fc1ecdf56d35cb4da10b683fb560e42983389925", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844510, "uuid": "0be55796-0760-4f51-bd67-54ced5b15ccf", "comment": "Malware payload", "value": "c2dbaf294e1cbe88afdb89a16383c7c531775b171fa9f45e6b595dc5fb5a2c32703b4872b6a397bbbfbc0fc6feec26a2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844510, "uuid": "cdf90ef0-34c2-4396-8619-07a0adab103f", "value": "E394237126CA6F9CFB3516BC525A1B23EDFC14476A8DD19B20267DC2530BB34026ADBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844510, "uuid": "d0cfeff6-be2c-4307-b69a-c53d896eb6a6", "value": "6144:2UTMDW0UxKhq5Y7td0UbFUV6cO60Cs+OG4bbFxJyvdGWWsIOwGHWBE2NChq:VTV4h8Y7tdLZ8O6tsvC/WsyG2BE3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621844510, "uuid": "4bdebd0f-aa72-47d7-bcd5-9faf10f9928e", "value": 413692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621844510, "uuid": "9454066a-fc58-4696-aac8-c3747ba97e1a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844510, "uuid": "4102363e-56ae-45fb-b69f-d1a48177bc86", "value": "Notice.11672765.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c46c8ff-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621864893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864893, "uuid": "1de9fe52-9d20-4950-9a3e-94780994cd5c", "comment": "Malware payload (Loki)", "value": "0e694dfd46ea005123f7955e402bb58b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864893, "uuid": "621fe167-88fe-4705-adb5-0cd3c783874d", "comment": "Malware payload (Loki)", "value": "3e7f4c67eb20e0f626233adce2e9c67d4516a93658a1821087ad482bd43162cb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864893, "uuid": "c6f2552f-f5ba-4b86-98b9-074087755199", "comment": "Malware payload (Loki)", "value": "749b1cb095f4d50dd98189f7e74e6e54a1543869", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864893, "uuid": "306cdfe4-e09e-41ea-845d-3bdf9191dc07", "comment": "Malware payload (Loki)", "value": "6b33f2e54039c48d212c92de7f7ec6b5774d3f364be6ff2a623270cb18218d91e1c9784eaf140ea8ba04643cd92c3550", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864893, "uuid": "809ad01b-606a-4907-ae92-72d8a32dff20", "value": "82849D886094B006D6D9767A4FB1CEB243769CCD293085337AFC6E9B37FE15B6205362", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864893, "uuid": "c9d476fb-83b9-4fec-9a4a-1232ba0f4273", "value": "3072:8QIURTXJOLkMWpISTsvnh1fkvPz0XpM+sP9AyMsWQZhT6FgoK+kO8:8sCWpzTsvn70gXT4X/PZ0FXK+kV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864893, "uuid": "9740fcee-5d75-4fe2-89d0-907dbbddbb1c", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864893, "uuid": "fc1d3bf8-0c41-4606-80cb-53dcf933fb2e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864893, "uuid": "dd02a519-eebd-42e8-9b94-3e5bd18f119d", "value": "0e694dfd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac244786-bc54-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621835741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835741, "uuid": "b4e77d08-5087-4b4d-95e5-6b36cf4e0343", "comment": "Malware payload", "value": "2165a079abe83077f6063b3875afc6c7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835741, "uuid": "7e2fdb7a-0251-46d7-8a05-c5452b1dcedd", "comment": "Malware payload", "value": "3e8da1770ce2ee5ff2d7f41bef3299f07a56c21086e92a697b0ba4178a4a0c67", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835741, "uuid": "bad06f4a-c6a7-4639-97c6-147282f296bb", "comment": "Malware payload", "value": "b9a76804266fd885330b314836aaa8751ddad21b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835741, "uuid": "4f86ace5-56fa-4654-be93-4a3622f77a82", "comment": "Malware payload", "value": "42606cbbc11057e9668558f3d8a8820859d8b3076588fe52ea0cdd898a71326f83997eb74f15791a19396b11c5a1cda9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835741, "uuid": "299a00f1-5385-4d42-8aa1-503f9d3167b3", "value": "23225B7989F15888C3FD9278C1CD7A4D725038126F037EEB266564E9287B2D22A3D7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835741, "uuid": "4ca6df15-e394-4186-93e9-0de1f57fa8e5", "value": "192:5/Xi1N4tV0zO6UGMrshmyzeqGvEqZSIcToCg8TX0300PK0ulCKIXcH:5/S1GShU1L/MqZCsCg8jP5KcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621835741, "uuid": "dfe058f5-8c0b-422b-9bc0-93c24fd56359", "value": 10417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621835741, "uuid": "576903af-0994-4883-84ea-3c23e81917c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835741, "uuid": "76b382b2-d889-4a19-b8b1-0beb2a73cac1", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a9cabc-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (Neurevt)", "timestamp": 1621872882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872882, "uuid": "54978ff7-ac45-41c7-9297-054a3de618b1", "comment": "Malware payload (Neurevt)", "value": "3f2695ef724c6da93359bcc8971c64ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872882, "uuid": "3c826bc1-0654-42bb-9d0d-08ea3a127b46", "comment": "Malware payload (Neurevt)", "value": "3e9827bdc12c88624681007f776b331d7968b7321e6f47f790b181e416631943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872882, "uuid": "11c7debd-91ea-4270-ae48-246e2616a690", "comment": "Malware payload (Neurevt)", "value": "0174058e799141698b744414b16057902afc546a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872882, "uuid": "f923b5b8-09c3-4e09-973d-3648975ec54e", "comment": "Malware payload (Neurevt)", "value": "8b719cf0970cfc202d753c0f59debe8d7196a3a818c980d869f112d2bfdef98de1385a7b3f68b7cdc84c7e40539cb473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neurevt", "colour": "#8F1B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872882, "uuid": "9d9bb56f-77fa-47af-a1de-53f5b5b39aac", "value": "25059D2C616EF126C1A8C2794AD4443BE590DB377032FD28ECD7279D5729E80BD8627E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872882, "uuid": "a859570e-ac90-4c70-847e-251007fc11c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872882, "uuid": "0d8cc53a-3d8f-40ae-91e6-f960d51798a3", "value": "24576:xBC7y1lsB4twEHQ6lyOGGHn+SQ9sdnpS:xBC7Gs+/HQ6y+nIsNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872882, "uuid": "27d8249f-2fab-4377-b000-386b6b29f8ed", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872882, "uuid": "08efdad6-7e82-4b9f-8f0a-b94a33f45894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872882, "uuid": "230a2519-1d7a-43dc-8bdd-ef34682e796e", "value": "purchase order 24.5.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722e88ba-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621864850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864850, "uuid": "f3cbdb14-f084-42c0-b565-2c36295fa030", "comment": "Malware payload (Quakbot)", "value": "48c668bd9287cbe66dd6a418d38c5aa4", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864850, "uuid": "8b66e6ff-3d91-4fc6-a1eb-0e321ed576e5", "comment": "Malware payload (Quakbot)", "value": "3ed0b5096a292afd77cd3fc10d08c74d7a6d6bc904842c1a364e1572c552689f", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864850, "uuid": "2fb0d2e1-7356-4771-adc5-692e25d024ac", "comment": "Malware payload (Quakbot)", "value": "465f8e08af485f1321a0c878d24bca8cade373e8", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864850, "uuid": "4981968e-5817-4408-a4bb-330171ac424d", "comment": "Malware payload (Quakbot)", "value": "d939349b5da101a8abf01f2d8c3bc20454d55e0e7087d4009fc566f85f96547aa1eebb071601f9f5284355fa15b790ab", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864850, "uuid": "ff84c345-b741-4498-80af-3766f3984ec3", "value": "F7156B67ABDEC412FB231FBEB1839A5406F2EC932132513D05E03615FDBAA7428A5774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864850, "uuid": "d23a3444-e05c-4a83-9090-3996e3e0d848", "value": "7f9f9682409eb2163578c61e196a72a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864850, "uuid": "31ec77c6-12e1-4237-ad9d-cde8ee48ae9b", "value": "6144:VlK9OXAC9Xh8lxxUf1ekOakB93mrxZIo91Ouf5sA7JIN:VlK9dC9XSlxxUf1ekOaCKgoZf5IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864850, "uuid": "c76d6c54-0fe8-4c34-8375-0635bd3be780", "value": 886420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864850, "uuid": "aadf8032-97e6-411f-a113-27ff81ad886b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864850, "uuid": "01d09c04-d4a1-4a63-9145-fd2537fd24e5", "value": "48c668bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0483e95-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621821655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821655, "uuid": "3906ddaf-6773-467f-8624-a0cd47db8395", "comment": "Malware payload (Quakbot)", "value": "4b7506aece8ee1438844b3df8a93ad4c", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821655, "uuid": "c589a159-5e9e-44a3-9939-143aff705128", "comment": "Malware payload (Quakbot)", "value": "3ee938901de203cb4ef077a786ec6d53361a6395c3524f7c4249d37c2998361a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821655, "uuid": "eadfc916-d4ce-4f2c-a065-74ff336cae5d", "comment": "Malware payload (Quakbot)", "value": "c8e4ff6654266d0a7fbb15e9a5434352541a0286", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821655, "uuid": "7cab0c40-c233-4aec-99f6-fa54bc2ad6ac", "comment": "Malware payload (Quakbot)", "value": "eb827267a90b24c65ae391a88ca7e778f0df4861bc94580426eed60d547ec22b4c88f334a1dd586046747c7ae21668cc", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821655, "uuid": "f94f289f-0479-4838-ba57-d1af8ba5186f", "value": "C2F49D23F6B14837D13367B99D1B52AC9C2ABE007D24AC4B6FE41E4C5F7D2817A2A153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821655, "uuid": "4319b6e1-db56-42e5-a96b-330856f89637", "value": "1b9d1b4f16c49288ddfa82ff4146f039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821655, "uuid": "90084828-84e0-4605-b76a-5b03e238849a", "value": "12288:yu7x/IO5zob/UPi4ez7lh31w6xzu/uSIKrX1U95RcYPXjS:yQJZ5O/UP+3+OuzXrX2ZLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821655, "uuid": "c9370b06-7767-4e14-a6fd-7735b2afff9f", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821655, "uuid": "1da08698-3b8e-48c2-a499-f770e9d97c5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821655, "uuid": "9266da1a-77c7-41f0-b8ee-325bdd018050", "value": "4b7506ae_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff46a32-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882992, "uuid": "6bae3d99-2090-4b21-9515-cf302ebb9c32", "comment": "Malware payload (Dridex)", "value": "bf1d38ac8a043c23e87071a2fcdb9b37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882992, "uuid": "33cdff2e-dadc-48cb-8ed0-d449224ee55f", "comment": "Malware payload (Dridex)", "value": "3f013b020fb95e626e7c19d25cb045b0a8ab113aadec565758db65f926e8e9f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882992, "uuid": "0de9767b-cc01-48a2-a8f5-0752544d1201", "comment": "Malware payload (Dridex)", "value": "2db19190d9939c91352ffa4fac561cb882778ecc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882992, "uuid": "9967a159-6b4a-41c4-904f-5d16e73a4a78", "comment": "Malware payload (Dridex)", "value": "4c85721b7cb89603eae616718bc7fd3b7f1cb14fc22ef6a724db8d754ec4f0c84d2bc57f9d917b43768e5991e929ec50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882992, "uuid": "72cdad0f-1e90-45b2-9b6d-49baf8bd0ad8", "value": "1FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882992, "uuid": "113a5fad-81ba-4385-9dcd-15856850ff05", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882992, "uuid": "e93e6dfb-b98c-4e44-857e-7af283371264", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882992, "uuid": "71baf1c6-4fbd-4517-998c-613ea2d6e1f2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882992, "uuid": "f593f327-6fe5-4a39-9436-0c3263839aaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882992, "uuid": "f0d0914a-608a-48aa-8365-f5a6110fed54", "value": "bf1d38ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb541d3-bc96-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621863960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863960, "uuid": "927bf379-5808-4da8-a8f7-4ead0e5ce306", "comment": "Malware payload (NanoCore)", "value": "f5e6b2d3866192f969ccda4b03c9ad11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863960, "uuid": "cc31432f-1d81-417e-be79-ff5c50e6ca36", "comment": "Malware payload (NanoCore)", "value": "400fa4663cc89bd82a78b2acea20f8ca620679108287c1287f046b4365831cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863960, "uuid": "1e308694-13e6-402c-84a3-2492df1443d0", "comment": "Malware payload (NanoCore)", "value": "965739bb63d8b80ede1ea2c80e43c556ee59fb04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863960, "uuid": "85cebec3-bcf5-4636-a15c-7bcb014912b0", "comment": "Malware payload (NanoCore)", "value": "2899cf8489d6e1f818085e4f5e559e36c6a8ce8a4d3e8a3feccc8890cba92650a90e781e98e9e60795451e7473ddadbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863960, "uuid": "ecd13911-b582-4762-9134-29f3479c7f07", "value": "CE94F0067E11C54BC529C83AD996C5B80327DF43C923FB0B2955FA19F9323DAF44BA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863960, "uuid": "f8e86e3c-7105-444b-8cc1-1b892b3a3e7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863960, "uuid": "460d4989-e392-471a-a7fb-4ff518a7e00f", "value": "6144:vNEwhrfcphhpjnLg1vO8A15HnvCS8bXP1hqYqPx6FMQI77/7Nkbft:vNB0DjKJA1ZCRhqXx6Mv7Nsft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621863960, "uuid": "898e4075-b13b-469d-bbe1-d0033fd4da6c", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621863960, "uuid": "bf9afea2-7f04-4d46-a92e-2ec580204714", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863960, "uuid": "488a67c1-fb99-457b-8fa5-5f087cea33ff", "value": "f5e6b2d3866192f969ccda4b03c9ad11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414c20e8-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872499, "uuid": "fa75b4c7-82cb-4d3c-a7de-d480f613804b", "comment": "Malware payload (AgentTesla)", "value": "f7c4371ad917e8e76c45060276ca6724", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872499, "uuid": "4f70e5c7-eb90-444a-9614-11d663cfc276", "comment": "Malware payload (AgentTesla)", "value": "40605c1feaa9c3e6452f0f6c70390d2531a76c465fa5b3248a901f930645d284", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872499, "uuid": "58632eef-c527-4d33-8b69-2408502d2eee", "comment": "Malware payload (AgentTesla)", "value": "95b9319e8cfb4d83527db47cecbbf93d938d5b80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872499, "uuid": "48843abe-194a-4873-a610-5c9ded9cac73", "comment": "Malware payload (AgentTesla)", "value": "6133cc2bb7a38b9602ee6a805d6005f26671bd7414b9fdd73abeef64baf4bfbc4abc520e45557b5039e59935812a7f0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872499, "uuid": "3a13a84f-7ec5-401e-83e4-038d0bdeb0db", "value": "A3A4CF5D37A0759EC463CE329AA42C20AA31B477972BD34B6007256D9E4E6E7CF107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872499, "uuid": "b326f1bf-92bb-40be-b005-2399d499487a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872499, "uuid": "aa8c0d12-7730-4d2e-9738-eaac1fbd608f", "value": "12288:iVOCXQ0rFtyOTBY5+czfzLv5HMWlqLsCzDAMDMeEHWL:isl0rFtndKOWlqLsgAM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872499, "uuid": "0b12a917-ce02-49d7-a843-edd3b3b5e543", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872499, "uuid": "e52a23ea-c0cc-458d-8adf-2a064e5fec94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872499, "uuid": "161c7c1b-e72f-4564-b3b2-72a3b6d5f325", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d20e7fb-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890155, "uuid": "80b27caf-3d57-414a-8b56-512e5dc12110", "comment": "Malware payload", "value": "e54c9cca2538db77770b2e43e1a85ef7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890155, "uuid": "8724b961-609b-4eea-ab91-a4fa64dac79d", "comment": "Malware payload", "value": "407e89d6744c6a9ef582e390eb3dd7d94901d7a32035887cf9fe885242983eda", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890155, "uuid": "f0e56ac3-cffb-4d2c-b914-d6b04b52e4ae", "comment": "Malware payload", "value": "ff04b4eb9d08126dbdd0f54f647c2a959030a7f0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890155, "uuid": "8db80f8e-f7f2-43a7-825f-d5abcf2f2874", "comment": "Malware payload", "value": "e78435f37b70955ec3f45e74b23db4e9cc9c34d9b56e45c41e749da8e90f2dba28a88a6cf6c3fdd0a950ff42b5f50c15", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890155, "uuid": "62c6b391-d695-48ae-85e5-b6edd5e9e1e8", "value": "AEF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890155, "uuid": "097d4943-055f-4f12-b8e4-828cf5d8ca70", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890155, "uuid": "b8c92424-ff9c-4656-b14d-e389b69702cd", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890155, "uuid": "fb0c7282-03e5-4b76-b9c2-00b2d9c6f1a5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890155, "uuid": "fb3d8411-1772-47f5-806a-21dc88ced604", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890155, "uuid": "9c21386a-b636-44b1-a617-369c8d5b5911", "value": "e54c9cca_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9588dd0-bcd4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890739, "uuid": "586653de-b3bc-47da-8fd6-988ec0fb9752", "comment": "Malware payload", "value": "026d639a59e099a90be7b3bf1621feb9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890739, "uuid": "703df70b-e9e3-4c6f-b1cc-a3b6ba53dd54", "comment": "Malware payload", "value": "40879da36e31a3939f3150da9bccefc50f252bc97614850f09503320ca02b534", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890739, "uuid": "7e336603-8763-4f0e-be3f-c8e208d594b0", "comment": "Malware payload", "value": "ff25c8c1f4728466a04c2112f58e9c06a6aedb09", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890739, "uuid": "3270238b-4663-43f2-8c76-11dbec9005fd", "comment": "Malware payload", "value": "9192f1f1001a8d2e3b3442bae59f926fec16fc9b33d582bb860e49afd8e84d3efba5a2a4461a823a881a868fb9b6c831", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890739, "uuid": "60d9549a-fa34-4410-aa68-92af34877455", "value": "1025227EDB4442B3C5FF047B63A41201345B6AAE177347E659A153901CB72E0AF3AFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890739, "uuid": "60781974-579c-48df-94be-fc3c3271d638", "value": "24576:3U5Kx+U5Kx0U5KxPU5KxnU5KxEwUnLoOjjreMBS1baC6u9qp1lhAIJ9XL9:3D+D0DPDnDXLqveMBkPqp1lhAIHXL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890739, "uuid": "52a0d13b-929e-4768-9031-1d897d250475", "value": 1014234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890739, "uuid": "be8c1283-de1f-471b-a68f-cfcf6f8c282f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890739, "uuid": "4ab77bc3-ea72-41e1-956b-25b9c506d4e6", "value": "apk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5632ca-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850559, "uuid": "5a550964-afa1-4425-b183-8baf304d03a5", "comment": "Malware payload (AgentTesla)", "value": "7ff82a909e532642d16e30a0d4bd723c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850559, "uuid": "6c7009f8-f696-441c-95d7-2b38ed2c4e73", "comment": "Malware payload (AgentTesla)", "value": "40b42bddd83d813de354b60217288e0b212ab965bb84e1dc19a6777906d1647c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850559, "uuid": "c4b5bfbf-65fb-4c65-b50f-b396ea79ed15", "comment": "Malware payload (AgentTesla)", "value": "bb5135b2b361312a2c9b66e60d4c178ee3a7a745", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850559, "uuid": "b0d504b9-785b-43cd-b93f-b476ad8b9dc0", "comment": "Malware payload (AgentTesla)", "value": "d76541f4a64969b5b7a83471da3025f39f140c5bf57fbfd854eec9d3f3dbb09f1df222ffc76afdc84a803db65705aa47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850559, "uuid": "b37027e2-6563-4db2-8842-516205db22de", "value": "B9B4E03226899B59D47DA7399160160013F0F89AE733DB59FDFE40E9363AE504BB3623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850559, "uuid": "89a259c7-604c-413f-8c0f-30ec22c3b2b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850559, "uuid": "27a87c8c-78b0-4e79-877a-9805116c5d10", "value": "12288:veq5bgKUue+ZpNAdn4Pvf0iZsMry6dd6GTOs0FBlKz:mIHUv+ZAWHfLZsMv6Gys0sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850559, "uuid": "93988cfd-b390-4d24-991c-2c29c12061df", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850559, "uuid": "9379bf55-db29-48de-aeee-1932767a048f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850559, "uuid": "60008b5f-94bb-45de-88cf-95200d34eba2", "value": "lNG1zdi8R1BPDAw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb18f12c-bc72-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621848678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621848678, "uuid": "dd035882-c7cc-47de-89ff-c16f5b4c2ed0", "comment": "Malware payload (AsyncRAT)", "value": "0e83d349cb22dd753d10f234c2abf20b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621848678, "uuid": "367b6720-6fad-4df4-8aca-189d6fc26bf0", "comment": "Malware payload (AsyncRAT)", "value": "410ab8ce38a5fd9868cfa4a023a7f28647ce1c8c44501f13ec8fe3040d7a85c5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621848678, "uuid": "7ed564d9-b51e-4133-8f28-637b3138e9d2", "comment": "Malware payload (AsyncRAT)", "value": "658ea81077bc0e34ccee8fd3bab20afd4732ad5c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621848678, "uuid": "0dc0d426-eeec-41aa-98bf-2eada7635e56", "comment": "Malware payload (AsyncRAT)", "value": "c24bbf83694686b5712507afb32a8b240d088e99b84877ce4614076768d577d413286a1cab197401b1af5f3262cd0210", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621848678, "uuid": "ece13679-01fa-4a7d-a122-94f892ac56ce", "value": "2504124D62C5E43BF84649B01AB7F77DE3BFAB051A9169B30F241FBE28260934E0D552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621848678, "uuid": "443d2855-f6eb-4f3c-8e01-0e532bd28990", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621848678, "uuid": "c57bd269-7d68-4587-80c5-c9935c80d8fa", "value": "3072:8QIURTXJSM4Pl7gtWxpgxwdVj6AaHZXJGu4Hw9fc/51nUH2KrA8wb5QtkDHBSWEg:8sB+h/zyzGx2oLUH2KsQ2oWEpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621848678, "uuid": "c02a287b-3192-435d-84f8-6c68c95041ec", "value": 173168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621848678, "uuid": "4615ea55-ecfc-48a4-99ee-dc70a58bf4f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621848678, "uuid": "f260d483-8735-4162-9d00-aa6b763517bf", "value": "RFQ EMFA Elektrik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc415aea-bc52-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621834909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834909, "uuid": "8b76a881-2bf0-4612-b2ce-4653221a0c39", "comment": "Malware payload (SnakeKeylogger)", "value": "e88abc1e2e1c831079e0becc6040d4d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834909, "uuid": "05f146c9-2e34-4470-a28c-dbc9581bac17", "comment": "Malware payload (SnakeKeylogger)", "value": "410c6c70948bfa93615effd7623603ab3828bf91b549b2c55476344755e3c238", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834909, "uuid": "500d0fad-0c38-46e8-8427-7c2961f07847", "comment": "Malware payload (SnakeKeylogger)", "value": "ece17fe52036c62d2f45df4c669d57171fe1ceae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834909, "uuid": "864186c4-35c6-44e6-9114-d17134256c08", "comment": "Malware payload (SnakeKeylogger)", "value": "b1c0b7eedc11f0bd36d72838d1e74451300e582a901b319f72fff687a61f677ecacb55000dd7a2aa305d5a3e1dba6edb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834909, "uuid": "e8cc68c0-3a09-4699-8300-383123c38a10", "value": "8DF4E0A016F88F25D03C837D8874E8208FF0AC17D76ADA09BDDD729A6FB6B415927705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834909, "uuid": "1bfc3c35-0cb1-464d-96e4-6ad2321cfba6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834909, "uuid": "6d5341b4-af92-41a8-8f0e-fa8fb7340c76", "value": "12288:UTG7rsgvgZKz5yiOi6KDLgtiP1vf4V5N2uNwtJWPFsnlaJIy81M:Ecz5yi3gtit4DMftUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834909, "uuid": "eb89472c-e0b9-4866-a060-912c962c4c32", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834909, "uuid": "e97ce60f-b951-41e5-aec2-18adb2685d97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834909, "uuid": "b2da5166-47e8-4434-8835-b9c8a8cda3bd", "value": "TT (Ref 018006 6743).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d719012b-bc5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839679, "uuid": "4a3e194c-d8bc-4a3d-ab58-b34b288d0bfd", "comment": "Malware payload (Dridex)", "value": "e6e24c7447d1125e351a63210461245e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839679, "uuid": "8ab4cca3-45fd-4b64-bb2c-d26b5d025273", "comment": "Malware payload (Dridex)", "value": "41258eae2337e70c65bd6d840a32f4831e922aa32f9531c903139c0a783c4602", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839679, "uuid": "3262aa72-6a33-440a-a26d-9a2b8dc11609", "comment": "Malware payload (Dridex)", "value": "6362e357dab99f8f53af7060eafba8d004c79ca4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839679, "uuid": "99724176-0ccf-4d8e-b4e1-76e911b05472", "comment": "Malware payload (Dridex)", "value": "e043e527a2f1ac3c9233352c9aa5ac0f18ed9aec854e6f2901708b020d7ca2b7bd2d708c4265058d105c777983f2c38e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839679, "uuid": "5b67b129-e1d5-4b5b-88f1-3fbac36b911f", "value": "F204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839679, "uuid": "ac755941-b695-4428-a47f-49646c85ee36", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839679, "uuid": "e988727a-b3b7-4204-a382-d61dc59e4a1b", "value": "3072:qWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:qWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839679, "uuid": "3461930b-d52c-429d-b2c0-e437ad0483f1", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839679, "uuid": "ee2e7386-6ebf-4280-8450-55ccf1738242", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839679, "uuid": "b780fdc4-a9fe-4b8e-970e-387b074c1d96", "value": "e6e24c74_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c3367e-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854036, "uuid": "c477dbf6-4d0d-4186-99e4-8e6404ebf817", "comment": "Malware payload (Dridex)", "value": "136912ffdaad23f665c206e2395216f6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854036, "uuid": "18939af1-25ca-4f09-8759-b58df72f8b83", "comment": "Malware payload (Dridex)", "value": "413031e9190d38887497e514d74f51e291b9216c219fc1035ee31826727f883e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854036, "uuid": "e6ad7577-8fe2-40a5-beab-e58155c322fb", "comment": "Malware payload (Dridex)", "value": "753c628d7d54c27d082e71ebc6a1428d712ee977", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854036, "uuid": "2abad5b8-fd8c-4b52-a04a-fd62f2e57aa2", "comment": "Malware payload (Dridex)", "value": "4ef5b2c91f611a1a73786797c2124dfc3bace3602b64bf752fb1bcb0028b6b43a8bfcb4e1e72bbf567dfe91fa4ce9768", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854036, "uuid": "1bd0983f-2246-4320-bfda-4a11f62379db", "value": "ABF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854036, "uuid": "f4598ffa-88a1-4b8a-867b-bed6eee6f089", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854036, "uuid": "17ad3535-943e-43d3-8eff-37f3167c76ce", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854036, "uuid": "ee6ae471-3abc-4dfc-afa5-07e2f9a884ca", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854036, "uuid": "b7bd11c2-0105-4068-887a-0538ca553f53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854036, "uuid": "f904d7be-4582-46b8-a545-72403a4fe43b", "value": "136912ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce6883a-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886557, "uuid": "bd59f89e-2eae-45f6-aef9-c640028f5690", "comment": "Malware payload (Dridex)", "value": "b7ba9779b086a8a2470af8dae0e93cfd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886557, "uuid": "726edd6e-a286-4d97-8dc9-f610278d391f", "comment": "Malware payload (Dridex)", "value": "416579d99e2cf71f10f132c029fdfaf6df790804d156e0c47bc02cd0690f45c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886557, "uuid": "58e1d0f3-a15d-4fd8-8c0f-7f7b58d4e609", "comment": "Malware payload (Dridex)", "value": "9811650aa623e7128a2c98dd33d05ef664505936", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886557, "uuid": "3c463187-5c38-4d52-be65-6279b72ea2b6", "comment": "Malware payload (Dridex)", "value": "a60d56ddaebc9a3b099af09f67afc07bbaa346d8e487dddc4188d67f79f89ee3384aca40b9c205416a9ec9cdfa1e6ca0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886557, "uuid": "59222d7e-9f5f-47fa-8be9-b12fb1972920", "value": "D6F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886557, "uuid": "c3b40370-4176-4dbb-913d-344dffb4e920", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886557, "uuid": "16d3f17a-e04f-46e2-8e0c-6b79a654c9d3", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886557, "uuid": "9185d0c3-7080-4f89-8dfa-f598a9aebcc4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886557, "uuid": "6ee2fffb-5e43-49c5-853b-1acff9b918f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886557, "uuid": "557406fc-fd42-4c9e-bfac-869351d3cb57", "value": "b7ba9779_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb51312-bcb7-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621878240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878240, "uuid": "932d753b-7a05-486a-a43c-c2670e26c20d", "comment": "Malware payload (njrat)", "value": "3c541111822f3cd1f538dd67ed1e018a", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878240, "uuid": "9146ef1b-1de2-459f-8495-dfe79ce9bd8f", "comment": "Malware payload (njrat)", "value": "416f3b7993ceaa6819402c66c9b2de0a4de163cd9765dd8dffe81cdbab538c48", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878240, "uuid": "ab10c500-14bd-4e2d-88ad-cc0c6528aff2", "comment": "Malware payload (njrat)", "value": "91f69b2ac54c42fd64d83e91412e1e903d74c6e4", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878240, "uuid": "4bd49038-04be-4338-ba28-2fb5f80c64c4", "comment": "Malware payload (njrat)", "value": "c709a2260e8d46bdfef3aaf984ba0a175529d977e7cd9d9314d3a3b7bb22576f4d9d8f3a733f05f14f8dec0425a777d3", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878240, "uuid": "ac45c5d5-c70d-4aa7-b5bc-0a409cb9a164", "value": "77F0F6C8100C21652FA218DB4E4F1D5C9218D574FBAFD620B56FE4A3A50F6E4466F742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878240, "uuid": "8b542f90-63e4-4c6f-b2f9-d89ca1476466", "value": "12:oEFjPhku/mV/M29meCXGCE0YSMM+Cq7MMVaiOMI:RJPOsaC4SMMs7MMhzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878240, "uuid": "b868ae02-d7f6-4393-adcf-588d4bfb76d9", "value": 581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878240, "uuid": "1a3e0817-f6a3-42f7-a10e-159dc5e8dcef", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878240, "uuid": "a7f4c6d9-b6b6-4b38-bce0-acbd1ff9bcd5", "value": "payment.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7752c36d-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882897, "uuid": "6b577dc8-94d2-4d30-bd42-f1e216ab13fb", "comment": "Malware payload (Dridex)", "value": "5ca89c82d5717f717e4e48ce768ee501", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882897, "uuid": "6bac90a7-0322-4dd7-a6c6-a97e9f58780b", "comment": "Malware payload (Dridex)", "value": "4170a0c0f137b90fec4ba91c24498b4bbc0b720c3de033828ff49b30b5471e2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882897, "uuid": "f2922d55-a515-43c2-a952-21b83d1a9ecb", "comment": "Malware payload (Dridex)", "value": "5391c5e537b67c5e66bc645b59bd2b744fa8c0ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882897, "uuid": "4cfb0bbc-ad2a-4f65-969d-ffe7553fda84", "comment": "Malware payload (Dridex)", "value": "16877f6ed3855a0f8b35a54ebe7a6b30660a9ec0b0325b01b197e67755dfc69ff30e038b0bd2cfe8373eca2aab3094c9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882897, "uuid": "4f140966-e9ef-45d8-acdf-7917afffe755", "value": "4CF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882897, "uuid": "dd1dd86e-507f-4dc0-8535-31e4ce76cc08", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882897, "uuid": "d7abca72-1726-414b-a753-47f9e2bfd193", "value": "3072:gFiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:gueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882897, "uuid": "8c17c501-ce5e-4f3a-8e58-f1a545d7fed6", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882897, "uuid": "27d92af4-fd3e-4464-9c1e-50c2c945f22e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882897, "uuid": "5fefea24-b420-4ecb-ba58-c9577fcab1da", "value": "5ca89c82_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acb07bf-bc82-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621855254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621855254, "uuid": "66373dde-a24d-4ebe-b41a-3eb5cc944a3e", "comment": "Malware payload (NanoCore)", "value": "4673deba13f95a2e4d4b675aa86881a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621855254, "uuid": "32b76b26-96f4-4e7d-ba04-5157d291d26d", "comment": "Malware payload (NanoCore)", "value": "41d0d4f9999b50bd9636508b7a247b04e6b919b8ed32d6119a570998d991f582", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621855254, "uuid": "4f0f624b-39b1-4a30-91c1-7e5b6420a71f", "comment": "Malware payload (NanoCore)", "value": "e79d54cc591a2d9b82a559b7ac8a684b30ccb3eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621855254, "uuid": "02a3a070-f351-4f20-ae4c-1aa86aed3975", "comment": "Malware payload (NanoCore)", "value": "96fa06f8e6819d3d34689a225eaabd3de30526cd69fe75337dd2104a001f6c93d3921c48f673630d404aed8ab54d356b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621855254, "uuid": "46c95cd7-981a-4cc2-bc8c-5779b6f1b350", "value": "7B84AE9C7790B5AEC877DE72CDA42C20E620B867572BD207605715AC5E0E6EACE107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621855254, "uuid": "c9884c66-6400-4c61-9983-1fbfb86533a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621855254, "uuid": "8c304c6b-411e-430f-8676-baf21d79f2a0", "value": "6144:4qQatgiNS4B0M8oYNCR3KwCkGCx6Y7pw/XcdoYnzEzQBzsbm/i8FUOEvmw8QqrmY:4qQatgiNS4BX8oaCACx6YFwPoJB46688", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621855254, "uuid": "df0b50b1-9e51-407b-9138-b2f302159e6a", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621855254, "uuid": "dbd0e029-cfd4-40df-ab99-733356611c50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621855254, "uuid": "ca24947b-27a4-4aac-8fb9-f3260617d020", "value": "41d0d4f9999b50bd9636508b7a247b04e6b919b8ed32d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1388dc55-bc57-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621836774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836774, "uuid": "6679ab09-97b9-411f-94cf-ab79c9d77a8e", "comment": "Malware payload (Formbook)", "value": "e4a004b849830fb847fd2d2a45ab7841", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836774, "uuid": "dc83f65d-aa83-4336-b7e0-002663915bfc", "comment": "Malware payload (Formbook)", "value": "41d0e5e67449f4f8bdce0b17cda2352a69484e2141840fe7aa7853364f945398", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836774, "uuid": "e28bd55d-4e70-4b47-b402-49aee50c97f1", "comment": "Malware payload (Formbook)", "value": "3b4179662ef7f8d02bb49b71705e9b8f8e09bac2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836774, "uuid": "bc1313e6-500b-4e85-8f4c-48dff8fac40f", "comment": "Malware payload (Formbook)", "value": "1670d02dc4e8bc61d8c2d11327667c632836dc006a2cb4cb6e5fd172efee76bde94c798c4ef027933616de778602dff7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836774, "uuid": "ee28fa28-0be9-4666-bb97-54ef09cee813", "value": "C3F42344208C2BE27C3516DE4878ED14C855298BDCBDEDE9EE3AF5E267044DE09439BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836774, "uuid": "f379a504-45df-4f6d-9887-740fb6f5e486", "value": "12288:+Fn7xAtozsbLHhEdU9VaVDHAvAUyC+dLwIyjXqPrQGu3JLeupLwclIM1lp:gStozsb76dGaVDHIA8+dLw5jWrmeutwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836774, "uuid": "2018aca8-1f89-422c-83fa-798a6128dd1d", "value": 748734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836774, "uuid": "cdae4a14-2fd0-4493-844d-5963317418db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836774, "uuid": "60f7f2e5-fe33-4de5-8b90-7cc2ca28a03b", "value": "proforma invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68fb0d9a-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879437, "uuid": "3de3d5ce-9ca0-4fc0-835f-606ed6498aec", "comment": "Malware payload (Dridex)", "value": "0f41f5fb0ccd5b0b897e8deb0b910503", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879437, "uuid": "b3f4fcc7-a9ad-40c7-831a-af97a4e424d0", "comment": "Malware payload (Dridex)", "value": "421383df97bbec09e798573fd005da3725ca6ff2c5985484ddf5e8560f0dec6d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879437, "uuid": "6cd6289c-60eb-408e-b755-20499d84d1ed", "comment": "Malware payload (Dridex)", "value": "ff64c50b91c27a0b534e91057fc7416168f3f24a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879437, "uuid": "ba45cd70-5d94-44d9-a3d7-7f1702008aa7", "comment": "Malware payload (Dridex)", "value": "f6c11c92783c4f34792bc377ad01d23a1e3d04764971888bc251908caa1bddd1d1683b4e1d75c8b2885d0477152ebdd2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879437, "uuid": "b430e0a6-87f8-45cb-9180-05d72d51c405", "value": "8BF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879437, "uuid": "7b568e92-f2f8-4689-beef-be906d5b96a5", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879437, "uuid": "ae342c3f-8a33-4b55-9dc6-09d3bfee50f4", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879437, "uuid": "9bfb1edf-6633-4b9a-889b-b6a2740749f0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879437, "uuid": "2db82e9b-eb83-42aa-8d55-06bcb5d02767", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879437, "uuid": "2134efa2-439f-45c9-94b0-8e8857195b50", "value": "0f41f5fb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f531bdef-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872800, "uuid": "87a2aeac-0dd3-438f-8548-1b77729b478a", "comment": "Malware payload (AgentTesla)", "value": "7a97ca8945edb0d04b17d48318ed4f08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872800, "uuid": "b5d64ef9-b63b-4ba5-8fc4-ae2b7ac7adc5", "comment": "Malware payload (AgentTesla)", "value": "4313f640332e2dc722524a6f469179212eef3e5cf9680c7451a0bfea0ee4a563", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872800, "uuid": "f7c5bb5e-625c-4df3-af25-bf2e4b46fcce", "comment": "Malware payload (AgentTesla)", "value": "fb93ab42da21853ce966a775f6542d6ef7556d80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872800, "uuid": "1ffc4572-066a-40ca-a23b-40d53abfabc8", "comment": "Malware payload (AgentTesla)", "value": "af6234b9cd5cec1b05b9ce1e2d2de7e7023dd7731873de271e67e3792a2fef03e921fc3220bd6a0d8d2c6e8bc326b0cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872800, "uuid": "9086e39f-a97c-40a6-82e0-ad6162985702", "value": "F1357BAC2259E121D06EC27845F69527F522D33FA831AD18ACD36F4E3F26F81785216F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872800, "uuid": "c2a73527-3fb0-417e-8c84-555581b4636d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872800, "uuid": "ce13726c-a6cf-4eed-bc25-42ebf47cd20c", "value": "24576:TskTnc9tsfxxE8t7qDOnruHUbYSO0u+tmqdyA:q9SxN7qD6OOOb+IEyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872800, "uuid": "22ff1fad-690c-4fdf-8729-4264aaf2a2eb", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872800, "uuid": "4150518e-db30-4156-ba97-874cec335a25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872800, "uuid": "7805fa14-b747-4cc0-aec9-5e3a078836db", "value": "FN019tY2021 Proforma Invoice New Items Stock Shipments+Payment Terms & ETA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22df9177-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621875884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875884, "uuid": "d2dc7bfc-8e8e-44f2-a158-6b6a2f8e5716", "comment": "Malware payload (TrickBot)", "value": "a915d76c4494efea9c6b39250604d7c5", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875884, "uuid": "d3bfce81-0765-4dbf-923b-f06c3985bd4e", "comment": "Malware payload (TrickBot)", "value": "437d0b75f67c18c12a35d9c0e1a32fc57b426834fa4df63f30f11cb17dd24528", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875884, "uuid": "c06da8de-b247-40c8-b7bf-efbdfa31eb52", "comment": "Malware payload (TrickBot)", "value": "068d94769cb2f41ec502d7e004fc5f4aeb8f9284", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875884, "uuid": "a36f638e-0186-4125-a48a-630334147f04", "comment": "Malware payload (TrickBot)", "value": "e2efd24a59b454344c94dd5cc8571a6ad9c44486ba9875b63df348669ccf34f876cec60c986ed94a57c4ff2d5f796448", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875884, "uuid": "c20622c5-f64b-49cc-bbfd-a626f2426900", "value": "8A256D8E678A4122D4EE05F287716F7EFA7EEF269313EE07134842BB2435439474562B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875884, "uuid": "503f7d13-14f8-4ca2-94b6-11ffd0969c6e", "value": "66f30f63084b0523f8f1d74dbceef0e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875884, "uuid": "58648b9c-d361-4be8-926e-03848151aac3", "value": "12288:oToYaQdlYuZS6QR6OC8VF+Uth3dXeEtvUELxGkz9ab8srQpERFd:oToBkmpAOC82qh3Pt8ELxZKVRFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875884, "uuid": "6c1a17c7-59c8-49e4-9ca5-f64c979bb51a", "value": 1044542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875884, "uuid": "d586cca7-3fe8-485e-8991-eeeedd904924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875884, "uuid": "1018db5d-9651-4ca2-a969-221c8008100d", "value": "UJFcKUqgmf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024bb987-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621871104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871104, "uuid": "f945636e-384b-457f-a22b-46c2072f5c08", "comment": "Malware payload (Formbook)", "value": "291bb2e66aa83f720406755aa0e43832", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871104, "uuid": "4a6688af-6b58-4df9-bcbe-58e3fa214ffe", "comment": "Malware payload (Formbook)", "value": "43e9194904503eb5a508cf89297b8dbfc73f79600ff6bf13c5d8e717941e2652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871104, "uuid": "1cc13356-cd16-4309-99da-7f6c925c5f1d", "comment": "Malware payload (Formbook)", "value": "052473b1647481bdcbcbc50bf911c502c7ff022d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871104, "uuid": "bbec010f-1864-4020-9a23-b07fd157d215", "comment": "Malware payload (Formbook)", "value": "e3ed9a7a08cec99a31594d205ffc90d60dc28ae2a54606472cfc0b4e8cda9483647e640eb5d31bf099bb680b80118bbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871104, "uuid": "1c36eff3-5997-46eb-9ca9-b7e0c2c72be9", "value": "4165DF2C516EF122C2A9C3B94AD8443FE590D7377132BE28ECD7579C1B19E41B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871104, "uuid": "5a87b5e8-212b-4987-a207-2607854ae44a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871104, "uuid": "041756a7-0830-4b66-b06f-8978a58fd2d8", "value": "24576:fBCb5RxC/Ixg+g0NGmc+Nvj+a7x/VQTdBsYXP0nIUZ7RZh:fBCb53C/EgD0NpBETvsYXP2Im7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871104, "uuid": "18c64dfd-48a7-4897-98a1-1eb0e2cd6341", "value": 1486336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871104, "uuid": "4ce23f01-68ea-4c9d-8c49-01a7988329b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871104, "uuid": "6e1cc5dd-5acd-4d77-b886-6504614a9a4d", "value": "bank slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb6a932-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850558, "uuid": "1a01bb75-8712-4b0e-b5a8-36bff2e5b830", "comment": "Malware payload (Dridex)", "value": "86fd7992d29474f28afdf2b3ce7f9c34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850558, "uuid": "ba96f1f9-8058-433c-aaa2-02f67d93b390", "comment": "Malware payload (Dridex)", "value": "440854241ee498edc1133f8c03eb9759271a84f796c05228f34e8b9bf11f9d1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850558, "uuid": "4d5695a0-fffc-484b-8b0a-56e3d4322803", "comment": "Malware payload (Dridex)", "value": "bb63f11174ea83614d37d5e82aed88dcbd8ce21a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850558, "uuid": "bb9f5d19-78d2-4e48-aa01-0e864cc685cb", "comment": "Malware payload (Dridex)", "value": "10409f2855d8b593274bf05a4459773267bf1121f78d5ece0c1390b8896f75196f8b4acaadc6c090ad75021055482f60", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850558, "uuid": "b2bb2ebb-ba18-4bec-ae3e-bc09c17741a2", "value": "C2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850558, "uuid": "9e337032-0a85-4d70-8732-7b17ed25ec51", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850558, "uuid": "2360c86b-2743-4bce-97c0-17c6fa74b46c", "value": "3072:ymNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:jLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850558, "uuid": "17c5c5f5-439d-4c5c-8ed7-8cfab39b5968", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850558, "uuid": "f7fda66b-da5d-4b96-ace8-c719e8ae3f41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850558, "uuid": "b28b6ae6-af64-45b0-9df7-1e5c2135de1f", "value": "86fd7992_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822eb7c9-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893653, "uuid": "c3a801f0-f3fe-4d27-b82a-787f9daef355", "comment": "Malware payload", "value": "d1d5769089df1c345609dac531c875ba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893653, "uuid": "2f1fa5db-d853-4f6e-be13-7fda66a52726", "comment": "Malware payload", "value": "44476cc179248c17a54b9026ca5cd0561573dabc1ce2e554ec0c8686d5b7861f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893653, "uuid": "cdcbf185-4a9e-4f54-b379-9517623f9963", "comment": "Malware payload", "value": "da5ba23ea54abaa3baff03569a92342ec2d0c9d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893653, "uuid": "26301bd0-a7b7-4c4d-b842-986fa6fbe670", "comment": "Malware payload", "value": "c9d172bde035563abb606fdebaf9f3e9040a08214a80e625f9e8d7e5fd0f6f99ac170d4fd27d94eb5d9dc6093a9697bd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893653, "uuid": "77ddbff7-610e-4add-92de-f4851b8a57df", "value": "01F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893653, "uuid": "bf09ee20-ba95-4bb1-915d-970f1bd30692", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893653, "uuid": "76c32ef3-cceb-4e1d-be7f-0b7767bcdd65", "value": "3072:RA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:R3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893653, "uuid": "9cc8f4ed-b74e-48fc-a043-326e36ccf06b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893653, "uuid": "89ccab52-6595-4baa-99a3-488fb409ae38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893653, "uuid": "52cbb1a3-ae15-4e78-85b9-7232414fec8a", "value": "d1d57690_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bf3665-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621861368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861368, "uuid": "229d142c-1ef2-450c-98cb-5603b0d3eb01", "comment": "Malware payload (NanoCore)", "value": "65b12e8656ee4e3c81a347128eea2997", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861368, "uuid": "6a15618d-66a3-4261-bc04-670d7cb72882", "comment": "Malware payload (NanoCore)", "value": "44aef5a93520da53d8fcbaebda649d93566a4e4631812bb53572263a4c7f627f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861368, "uuid": "43a8fe1c-06b5-4403-9aaf-cf142ee4ce92", "comment": "Malware payload (NanoCore)", "value": "4ac808d8ff98496249b3065444e23fb41c2c2fd2", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861368, "uuid": "68ca4ed1-a911-4a53-9211-6f5fb39e6678", "comment": "Malware payload (NanoCore)", "value": "8fbbd166b24ffb8d0b57d917cd4892dd4f36a739da62e7f4f4a8eed2e53571b03ea0a3e1690bf10a4cf90cfc540b7a99", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861368, "uuid": "ca3032fc-f376-4fea-887b-242178730eca", "value": "44F412726A875575CA390E3141E365C0FBB573D33EA28A1EB1E9823C1891A4FD72274F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861368, "uuid": "384d6ef9-a92c-48d9-8a4b-fb3c97749709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861368, "uuid": "e23a0fc3-3c58-48af-81ae-d4616dc772ed", "value": "12288:Hmsqby21TzZylfY2BSSKUAMQiKCCf066tU+9/+OAFcVcZsVZgx4O1W47:Hmsqu25Z9SBAMQitCcNtUVOi/ZsV2x40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861368, "uuid": "be90cbc9-8cd8-4ac6-9166-724d2d5a00e4", "value": 727040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861368, "uuid": "97301083-ba2c-4f79-8eec-5476bb3931c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861368, "uuid": "6b941c33-367f-4cb0-ace2-5c028170ec02", "value": "65b12e86_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1347b012-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621868556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868556, "uuid": "9740d087-154d-4fc0-8dbc-8261bc3f34f2", "comment": "Malware payload (Loki)", "value": "42374a18216ce3b095cd95d8702cb984", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868556, "uuid": "3658e067-c0b6-436e-ba35-e6dd18302782", "comment": "Malware payload (Loki)", "value": "44b4fe7581292da3717937c548ccd46395bab60829ec72c4a27c79e46cc179c7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868556, "uuid": "cd07f869-bef8-46e5-a7a9-62d849519239", "comment": "Malware payload (Loki)", "value": "22a12029ec494e058c449c2fbbc7d73dc685ca96", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868556, "uuid": "db25f8d4-c6f8-403b-9f71-f617a7d2b089", "comment": "Malware payload (Loki)", "value": "ab963c30f586d6bee0902d1b5221dec87d1ea054207ea4330d6f0fd5aae84b5ad4e224e6a19972bd79331dd2a39811f6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868556, "uuid": "ce4165ff-f46e-4de6-b1a7-359ae2b25f22", "value": "6564AD886098F046E6D9767A4FB1CEB243759DCD2D2085336AF87EDB37FC05B6205262", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868556, "uuid": "32d9b2c2-a7a9-4f15-86c7-719647b3b3ea", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868556, "uuid": "e7729d0b-d8ae-4768-acc5-83044234da12", "value": "3072:uQIURTXJOLkMWpISTsvnh1fkvPz0XpM+sP9AyMsWQZhT6FgoK+kO8p:usCWpzTsvn70gXT4X/PZ0FXK+kVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868556, "uuid": "03bafc38-c0ab-4b80-a72d-54fd545098fc", "value": 319811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868556, "uuid": "3f55df17-19fd-42ed-b65f-72a3bcb986ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868556, "uuid": "8832979b-5b19-48a1-ae86-445414237660", "value": "42374a18_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684c33f5-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872564, "uuid": "2468ef3d-9d48-45c0-be34-4cf782f9e4ad", "comment": "Malware payload (AgentTesla)", "value": "cc48306686342fa69b67cdd02dd9e6cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872564, "uuid": "b7c53697-3b3a-42fa-8857-f325de110873", "comment": "Malware payload (AgentTesla)", "value": "44c296018e2c000351b3be34a1aef140342a3775002665d7ce0830c414e23c62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872564, "uuid": "7e6ad1a9-baf0-47b5-898f-0f893b27477d", "comment": "Malware payload (AgentTesla)", "value": "f517e842b632ca0a66911771c4dc80e03e728571", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872564, "uuid": "3a3660ab-0b8f-4429-ade5-8b4a0e722d5f", "comment": "Malware payload (AgentTesla)", "value": "3911ff82914d382964ef876aaa966f4ae9a4140e4d221e2b4c45d97c7fd3e7f926ba45db8d87ce60dac101a2f0e2ed91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872564, "uuid": "9fe19353-878c-4ee0-9349-9385e53bd2f8", "value": "5BA4CF5C3794B19FC867DE36CEA41C20A925B476932BE30B6017166D9E0E6DACF107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872564, "uuid": "9de3665c-46f6-45a2-ad27-04a12394892c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872564, "uuid": "4238fd67-db6c-4b73-b088-fa67d07c4bcc", "value": "12288:ikLmJ8w3m386lc0GyaseRgkOUDquBZy0O2I/:7mJ8w3H6lc0FheRgEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872564, "uuid": "bf8ca6a1-77e4-4437-9e83-cf56f364b56d", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872564, "uuid": "36c96fbf-0b1f-4c22-87ec-fbbb171751b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872564, "uuid": "1ea29bbb-a969-4809-9cdf-04bf541984a3", "value": "87VRGhNGfCFmCID.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d5c6a5-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872320, "uuid": "ca913870-7349-4275-a58d-b9e9d4122430", "comment": "Malware payload", "value": "0133f77e375274980804312e6da1447d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872320, "uuid": "d1f1d0fa-2814-4ac2-8380-51ac7e301210", "comment": "Malware payload", "value": "46117651dfeb1bbeb4dfcf30905a823b0795cf013b19d31c08d78ac0b4d3c0a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872320, "uuid": "e4703fd3-ed71-40c6-b518-0363e195c9a7", "comment": "Malware payload", "value": "53a94c496c76c3305101f610906f2db60eb192fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872320, "uuid": "58a705d1-a2da-475a-b592-175bb5d634a7", "comment": "Malware payload", "value": "c0b0aafe8ec446e246143ba1e3849d70e3af5c18e5ea60820d52c19fd8263245152f4f119271d1009ab817ff03f2f930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872320, "uuid": "41bfbddb-ab6b-4da5-bad8-e1b8fe039061", "value": "68642E5472FA2F86F4799BF812A3602087F66E1A286EC75F9DC375D72672F004A20D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872320, "uuid": "777c4683-2625-4403-bded-2acde5ae86df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872320, "uuid": "7c75d9cb-6de2-4c88-92fd-d64950ba70cd", "value": "3072:vJV1LtMXKSk7QIzH5bssgaeFkT2tAxnQ3+HzYvh6TQtvdJG0ZBdEor1jNAGOwA8f:vJ+CXVqkIAxamc6TGPBXSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872320, "uuid": "73912010-5258-4a5b-b4cc-1d57c3b5f228", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872320, "uuid": "a170b627-7d6e-4648-b37e-36a32dcd8c3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872320, "uuid": "ec9a7c58-24c7-475c-a352-f233cbaf5833", "value": "Pago May_Adjust_0774 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b361a4-bc80-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621854598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854598, "uuid": "a77295f0-d233-4e42-b660-ad2bb0205192", "comment": "Malware payload (NanoCore)", "value": "990521ca3e91687500f5dc1ff68a505d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854598, "uuid": "4d035149-873a-44b5-a640-47a439a4883e", "comment": "Malware payload (NanoCore)", "value": "4645299c38a1f4afbc3107d113ba21eb76c97b3cc3c1bd7ec6bd843f0bef3f10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854598, "uuid": "7836e8c8-f834-43f6-964c-3e454b948683", "comment": "Malware payload (NanoCore)", "value": "c9330d4fd1509a25859dfaadd2b94d427bce4596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854598, "uuid": "ff376dc6-3d8f-432e-b797-774da7b5484f", "comment": "Malware payload (NanoCore)", "value": "4c27358a7ca4aac96595bdf2bfe543490644e2290566e7744a7c864f89664f76052d82ea4aa1a99d41f5d5bd27962082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854598, "uuid": "0ee598dc-1860-4efa-bdd4-684eeb22d2c9", "value": "B415F1BC3ECA6CAFC02E6D3FE6902C659311A855064BE21F94337749874D74AC91DCAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854598, "uuid": "ce2b5f32-f692-48cb-9d97-ff1c0b607a29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854598, "uuid": "b88c9f45-98e1-4538-9cf5-a8740a27657f", "value": "12288:pE/Sk6oLkIzsE7mYtXI4EBa0uhAKfC6BpA1pqJ5umypJOBNIq1eU0JGInJ4shWW6:H+LDYEBzEB+HlBK/aodpQbx1evJZCJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854598, "uuid": "70652f0d-bdf6-4d21-a7b7-bee0f2414632", "value": 882176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854598, "uuid": "e9dd9e86-9e82-472b-8ee8-f81be2299128", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854598, "uuid": "3b58c110-07e4-4e81-95a5-04710f6fb2cd", "value": "MASTERS INSTRUCTIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6a6c5f-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621876057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876057, "uuid": "d1d909c6-9c40-4e1e-8a54-e8e329b326ee", "comment": "Malware payload (Dridex)", "value": "39a580c089b063af0df6bc270eff5abb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876057, "uuid": "50d1f716-1ea6-45d7-af28-60a95b861782", "comment": "Malware payload (Dridex)", "value": "4661c906fa0ab71746010f4ef73caf763c0c611489bd02125d0a31e00c3c087c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876057, "uuid": "7d1b1b24-756b-493f-bdf7-bbf06cebb7d9", "comment": "Malware payload (Dridex)", "value": "a1814262b4c660223bf4f3e991d1a9bfdffa7e96", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876057, "uuid": "6f4e07c0-be71-45ee-a512-cdef9fb43e39", "comment": "Malware payload (Dridex)", "value": "cec5a73d551c99b049ddebaabe4a1926aa510312fdbf0a11fd5b807c52ca0d825ed5ce51b1083e5b02e43c373d0940ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876057, "uuid": "7fb1201e-32b8-4053-936b-8c513f779cb9", "value": "EAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876057, "uuid": "8bef57a3-d05b-4e7f-99a4-fe2439106d50", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876057, "uuid": "d9e90504-41ac-4b5c-8ab7-1516f3f624e0", "value": "3072:0lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:0lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876057, "uuid": "bf195997-e111-4cef-b3e0-8bcfb9b0a1e6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876057, "uuid": "260a40d0-5f73-400f-911b-751dd07944ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876057, "uuid": "e5f8315c-d811-4c51-aa7e-518e17b78b7a", "value": "39a580c0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204085d3-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861276, "uuid": "92ce88fc-8425-42f9-9142-6274956c578a", "comment": "Malware payload (Dridex)", "value": "94d9edd72891fedcbc2b547ddf8bc556", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861276, "uuid": "86cbc5ed-01d9-4828-b76f-03255c13a917", "comment": "Malware payload (Dridex)", "value": "478f14841cba1c2a30fddeb468ffc081ef07d0d45dbffde07dbaecaae28906ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861276, "uuid": "648392e1-f47e-4bd4-b42d-d203d5251bd6", "comment": "Malware payload (Dridex)", "value": "33a8e319559dc37ff00f03493d1a8d7caee87e06", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861276, "uuid": "32d07ecd-7831-4e30-981b-b4917ed68667", "comment": "Malware payload (Dridex)", "value": "534f4963365fc57788406847dfc9d2bb40dca7d582b205cd5a6622de342b853afffaa0273559560881fb08b565e7dd01", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861276, "uuid": "8c0deec1-cd00-4fb0-afde-fcaa30617ce2", "value": "16F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861276, "uuid": "d94b38ab-4993-4e6c-b58a-a826069c2ec1", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861276, "uuid": "5d1e9652-3943-4306-800c-5768e2572981", "value": "3072:MiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:veAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861276, "uuid": "8aa563b1-2d75-44d7-85dc-0f28573fa18f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861276, "uuid": "2684ba3e-e8b2-4359-b915-57aff40b6de0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861276, "uuid": "da6f977d-bd69-41b9-9e67-4ffbabf2f519", "value": "94d9edd7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283cdc4a-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861290, "uuid": "fcc5a1dc-2d9b-43dd-a151-5e1a8273ffc0", "comment": "Malware payload (Dridex)", "value": "fbe1538368273e183d8161a2e0036c96", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861290, "uuid": "42b9b69c-618f-41ea-95e8-22295824a3e0", "comment": "Malware payload (Dridex)", "value": "47bae8d85001d8ec82232f8bdbe1755bf86091317adb279284c81f217c5d195d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861290, "uuid": "ab165df6-1832-4e08-841a-774abdf0a330", "comment": "Malware payload (Dridex)", "value": "3215eb210ac93db890645efbca59a91865524662", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861290, "uuid": "f3ef2e7a-7119-42c5-b6b2-52509c208273", "comment": "Malware payload (Dridex)", "value": "eafa0b89f1f0af22c8fe0aa8652603581e27e0cd7bc97a6e50b8e0b09a6252394f892898ee281c8bb147cc03f199c652", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861290, "uuid": "18a78839-585c-4427-93d6-5c2a86f40358", "value": "BCF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861290, "uuid": "ef92b2a0-14c5-402f-b414-9ddc2ad4bc7f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861290, "uuid": "b4f2691e-89cd-4097-b887-c8e533250557", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861290, "uuid": "83c9d55f-3b19-4bee-b694-29fbb2787ac9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861290, "uuid": "34158b37-81ea-4196-9d56-5b5b479935d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861290, "uuid": "cc4c0be8-f50b-409d-8653-9a6a967a093d", "value": "fbe15383_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa22418-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621846860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846860, "uuid": "beef1996-5216-46ca-b2c4-6d5bea979602", "comment": "Malware payload (Formbook)", "value": "8a5afe995d08b4d4f4da79bc87c42071", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846860, "uuid": "e6585b6d-ac16-4d32-a757-e9c37e8bd655", "comment": "Malware payload (Formbook)", "value": "47c26ad6ad20462404f1f13c5be9024a1f602452aca247b7c6de059a09dfa3ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846860, "uuid": "e3c50746-a8fe-4da0-aca0-76aa06da82bf", "comment": "Malware payload (Formbook)", "value": "1d803e1ac8526f87cb280dfc996403181a3f2586", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846860, "uuid": "027aefeb-3a0c-4a37-a53c-44b688a63992", "comment": "Malware payload (Formbook)", "value": "ea5b027bccce93d5aef77f054f5d94e3ab5a09c3fe36188972a634139a7337e385407a5eb8b2a52feffa3ab5110041a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846860, "uuid": "95d6e3c0-c1a2-4890-83f0-d7f2d364ac1a", "value": "F624122B35DA88B7E87760B30B79973FDBF2E744285A021F3B501E66B4B5257C431682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846860, "uuid": "85e1d0c5-803c-4e4e-b542-ce327a550a5b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846860, "uuid": "e770a107-5874-40d8-a724-b428c3fbbeea", "value": "3072:8QIURTXJSMTvV+4hwJL1DIZj6tyy4/lCXv77gP9rq/mf99aHN4TaGwSuDPIKHalP:8sBr8WsL1Dzy+v3g1YCDUrZHgrrwdWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846860, "uuid": "7d7b4350-f254-47c9-92ca-60a3b762a45e", "value": 216273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846860, "uuid": "2bc59607-563a-4fe3-9ffa-2c6b1a1b10f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846860, "uuid": "28a0b89b-3673-4931-9a89-8f8840953c92", "value": "8a5afe99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aeec9fd-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838128, "uuid": "212d6090-4ff8-4ea0-888b-0678bc083f57", "comment": "Malware payload (AgentTesla)", "value": "29b9cfb144df634334e66345cdaeb91a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838128, "uuid": "70664f1d-b644-4c96-8908-fda18bbc429f", "comment": "Malware payload (AgentTesla)", "value": "488b854fd4b358b13e6b804ce4eb04ce1931d56c3b4a3769d64411a09ffe229c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838128, "uuid": "cca9cebf-d763-4bd0-a99d-24245277d383", "comment": "Malware payload (AgentTesla)", "value": "958ccc2ca162fa1bd1e84a45f63b6303e88ebeb1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838128, "uuid": "065376aa-4aa9-4bc2-8397-19d6281457b0", "comment": "Malware payload (AgentTesla)", "value": "cb399b4dfa1d569fa3960a461adeee13bf518f8e4ab605a31f42d964af6d7abd58dd9b6d1bb52f38164a4099a393ccbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838128, "uuid": "9c687036-e084-41dd-a364-f54993a04baa", "value": "A0252350FA8BCF2BE1FB477475238A5859DF0C92ACD1A60256437C1CF5B8EB750A292C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838128, "uuid": "56680543-724a-46ee-8788-1bb9940b1cdb", "value": "24576:auyT7I2/aNRXV4j2pqn6EEY+3YtS00AVhDD9vNp:14B/kWjPnBh+otS00mXxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838128, "uuid": "f839953b-8c1f-491c-a0dc-3375b675771a", "value": 1022760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838128, "uuid": "c330962d-a483-4538-bfcc-ecdbf5c3f574", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838128, "uuid": "c676eba5-156d-444a-9033-1aea08b7f154", "value": "AWSC-##YU.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f9f326-bc6a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621845051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845051, "uuid": "d5ec865c-02d5-475d-85bb-85060f0bfc62", "comment": "Malware payload (AgentTesla)", "value": "24a45f793f6e34f9a955a5f03b2bcdd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845051, "uuid": "1a34b0f0-f620-43ba-8cf7-b6f94c42225f", "comment": "Malware payload (AgentTesla)", "value": "489c52cbc804d3b879ea5a000d0947abab28ad2d01cc532decd9686042ff83e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845051, "uuid": "ca0d977d-1d64-4d8c-be11-d3286cffdd69", "comment": "Malware payload (AgentTesla)", "value": "decd4936896a0c275d73dc81aaf5a524b43b495e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845051, "uuid": "813373fa-6e91-4363-a976-a2bd25d2714b", "comment": "Malware payload (AgentTesla)", "value": "2a186c47646ea3954bdabce1e19b5e9b54bb0062371fcc538b056232d6e15a4a706ea55efcadc302a2d8c324efd688b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845051, "uuid": "f85664fc-dd37-44c0-9767-aa1606b6af01", "value": "C035D01CA129A132F468C67906D36027ED18D7736021AD54AAF70B5F2F37EC0BB4A5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845051, "uuid": "e9f3325e-0a34-4adf-970b-8712a153f7d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845051, "uuid": "b8fe8d5e-8657-4275-bea4-ec40bc1f4b47", "value": "24576:FSZopjl3bOdc8lmEJvoFkeorlJgwhrt8w:vEdCkBXh8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621845051, "uuid": "719b4fe3-b7eb-41b1-8d53-955f9200f9f2", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621845051, "uuid": "2a5104f6-ae44-469e-8413-5313783092f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845051, "uuid": "9a2a66b1-9c5f-4fe3-ab97-4a2ea636d843", "value": "WP4Yi4JphPxkgxv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a466b6-bcbe-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1621881312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621881312, "uuid": "bd2a259f-ff8c-4f9c-b817-1d2935e0255d", "comment": "Malware payload (GuLoader)", "value": "183d19fafc8a252546f6e7cdd330a0f3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621881312, "uuid": "031ddd85-d98c-40d4-8ab9-dfdb120ad5cc", "comment": "Malware payload (GuLoader)", "value": "48aac53ca47241dd233ec894895239d5539c53b5e35310389529724a457555a7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621881312, "uuid": "2811cf45-129d-4a06-9f6d-ddf55fc9de64", "comment": "Malware payload (GuLoader)", "value": "71b2d0a0ebadaab01f1bc923b56bacd5c6986599", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621881312, "uuid": "d7976741-d4b4-4330-9a1e-2c154913058b", "comment": "Malware payload (GuLoader)", "value": "8f03fda09f443114f2919dd95b2cb5de87aa69b02bced2690687ca7281a08f3f1dfb2f459fff0f78de8233d34113093a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621881312, "uuid": "b52417f1-d2cf-444e-867f-5bb339b12ac1", "value": "FEF3C4BD6E00FD23C26A88F41B0B557830852430BDBB5D67E3C3DB5A76746E1AA18727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621881312, "uuid": "56303c36-352a-4a42-ba29-08fb89ae7d00", "value": "bac0045e142d72ef93e4f7c022040fd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621881312, "uuid": "b3d0d968-dc0e-47e7-996d-74e792891f8a", "value": "3072:FcQBZCJEJzODYpr2cficpH+IljREIKO7A2tLN:FcQBHJz862cfiCH+exc2tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621881312, "uuid": "ec86d45c-5f1a-48f2-b945-5651feb321aa", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621881312, "uuid": "412e87ba-e8e5-4adb-aa4b-ccb63395f333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621881312, "uuid": "874c007f-21d0-4e31-8093-b4cfe3ba2359", "value": "Delivery report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44961e45-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621838144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838144, "uuid": "c20db1bf-0875-4e83-b353-90466372074a", "comment": "Malware payload (AsyncRAT)", "value": "c98ccee0112722e3e4c45890857d6d1a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838144, "uuid": "fbe28379-cd39-4c82-8527-1025ef2c781d", "comment": "Malware payload (AsyncRAT)", "value": "48b677e101e54ab62b806e7bcd2b6a4547f70addd8b7baedcbe1083c41d1a4bc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838144, "uuid": "274031b9-e3e9-434f-9862-2562fe143232", "comment": "Malware payload (AsyncRAT)", "value": "b22e55c3ad1879dfca4545f841144fd62f3dcc9e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838144, "uuid": "74d3c12d-0e42-4bc9-bfec-536bdedd4c49", "comment": "Malware payload (AsyncRAT)", "value": "dac1b4daf25f19ee81ca0dc14b1a2f15820c45f1da9535aa1d60b6f928c2cfa63066ee6ef1bcabedab38d8089117ee2a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838144, "uuid": "c4f0ce94-6103-42c5-9a60-0b909fe694d8", "value": "5712A566068C1997F253C8B2D9ADFEA746B3F2AFD9CB2E90136CF8710D371921511784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838144, "uuid": "cde2c05d-6374-493f-922f-d63938180e8a", "value": "96:TOfvCc4uVS7mAk9ZN0izApMiJaNR5FTPkBf055GBmew2:6HCc4Nkm1bof5FD5GBmez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838144, "uuid": "ff6af0b7-1fde-4141-b90a-5ab52c2d040f", "value": 9364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838144, "uuid": "ad5d07f3-9f1a-41ae-9e84-0912ec8011c5", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838144, "uuid": "6a050150-a650-4ef2-90b1-61de231bb7e0", "value": "faktura 0835.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c5d60ac-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843365, "uuid": "ec1f3fdd-2753-451a-ac59-34fac019e0c2", "comment": "Malware payload (Dridex)", "value": "4ba7e8bdfc8331b369b0e8d917be507e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843365, "uuid": "f1b0fcf9-2530-4d31-af14-5e11dc5cacde", "comment": "Malware payload (Dridex)", "value": "48e45108253ab682f2b53afa0013c5e5ac21711b737d19d8e7eec9e26d9da7fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843365, "uuid": "b0e9800a-12e7-4d9e-9cc6-71d28b9181d5", "comment": "Malware payload (Dridex)", "value": "7eb9a98066297a06e1f503b80549022d32245885", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843365, "uuid": "63648692-695d-4cc3-afc1-064009397786", "comment": "Malware payload (Dridex)", "value": "cba87f08cef1331226479a6936d717fb07bf1070aa9c6b10dcaa1a212c1b5be966d31d023d6fcabc089314d536927385", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843365, "uuid": "bf2ade7c-c915-4023-b913-a9ff63dcd50e", "value": "02F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843365, "uuid": "e3453fdb-4bc9-4d62-aaa3-dd00966f2207", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843365, "uuid": "3ff8cf7f-a5cb-46a1-83a7-3d9860af8a69", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843365, "uuid": "1f45d885-000c-4e65-a2a8-82b6ec22a955", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843365, "uuid": "2fd2e9fe-1041-453d-ae27-461290a039cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843365, "uuid": "78708f6d-c1d0-45df-82cb-750c24588e74", "value": "4ba7e8bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d109c05-bc5b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621838695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838695, "uuid": "2cdb1828-9ba8-4d18-b56b-ab5d7b55823c", "comment": "Malware payload", "value": "2ce33da1d6926a2e56be1205c9c902af", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838695, "uuid": "59c3e8bf-2294-4060-9764-2e31f059655d", "comment": "Malware payload", "value": "48f1b972fa6876326731d03c1887d7e779b84fbf6836736578c0f3e0542d8717", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838695, "uuid": "7ee22d53-c179-4a80-b3b6-fc541947a579", "comment": "Malware payload", "value": "9b3973eb9894879bdfef4c69e5397fb8916d584c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838695, "uuid": "9a59f4f5-b652-4484-81d4-4c3ee52ce3f1", "comment": "Malware payload", "value": "b2509ea4f57577210c0de7bbedf711ed2d000487f4f020e68fbd5086e194b627b11915fa5c411d4ec34287ea3d8589f3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838695, "uuid": "aa1f94c3-821f-4500-a84c-d3a271ab337b", "value": "4DB42338A20F8C4DD3E9203AEC6D58DDC5762066FE45352DBEA8F460D8461FB5EA4BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838695, "uuid": "041ab7bd-ef6a-411e-8734-c3ec5dbde56c", "value": "12288:miavXAy95SQDGKeP+psM+/jHdO15pghY6ml40VKgGjFR2W+dM:mDfA855HePDb9ODMYdjV5iFRF+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838695, "uuid": "53eb4018-e45e-43f1-985a-2db49d323563", "value": 512823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838695, "uuid": "f48eeb7f-1d37-4b92-96ea-6c7d5c693b75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838695, "uuid": "305da95f-e3c9-47d8-929f-83eb75175b86", "value": "TRANS__906606.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973d5cb8-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818097, "uuid": "7e9eaf11-8856-4024-93d2-c66edb065105", "comment": "Malware payload (Dridex)", "value": "aabc0c57e1f94cd911cc7ad7df016e14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818097, "uuid": "3b0467f2-4fa6-47d5-a2c2-53c2ed46bdf8", "comment": "Malware payload (Dridex)", "value": "4907ca70b28695373378b52aa1c0e5d60a7688dd1133960a95a337132caa995c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818097, "uuid": "911249f1-0700-4cf1-ab7c-70d615c14538", "comment": "Malware payload (Dridex)", "value": "cb5a0254db3e4eb613aa7667ef43af3b6e589a9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818097, "uuid": "c74b3bdb-bdbd-43db-bdd3-65875907ddb0", "comment": "Malware payload (Dridex)", "value": "1ec36d746c7c86c0a44dcc3649614941271cf79d1848c5da4732aba66ccf094940587e3a21a95a225c3c86ae8d332ffe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818097, "uuid": "1126dbc6-9dbc-4762-9847-270320bfeb68", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818097, "uuid": "561e2416-0392-4287-9810-82ad90d73f7d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818097, "uuid": "afcfd37b-7b74-4513-a6dc-46974bc22af6", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818097, "uuid": "ad668f5c-7925-42fd-9b4b-9f6e9c9811ff", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818097, "uuid": "604680e3-91f4-4901-b756-6fcb9771d8c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818097, "uuid": "7b7526b3-69a4-4190-9e2b-9d09c0d597ff", "value": "aabc0c57_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0651da-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870341, "uuid": "9485e981-b960-49b8-8648-2022deb6a492", "comment": "Malware payload", "value": "c703b8dba7801e4e64059923eceac56f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870341, "uuid": "f4158594-2a94-47fa-ab01-6b63518a6e2d", "comment": "Malware payload", "value": "49ff84a3b2ca22e358c3decf349104859c80901e7141bd56959665e2c58b5955", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870341, "uuid": "b1ab31e9-657c-4113-9a3c-9c4161ecb692", "comment": "Malware payload", "value": "5808a9cd4fc52de74156f3f01dcf62948c7d8e91", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870341, "uuid": "802c3b83-2164-498b-a5b4-31aa1e07a27c", "comment": "Malware payload", "value": "6cc0b213f86719d264141d4529d8b33774c92025b9d57c6510fc57c1e05299cbec20daeb0af611c791943f363888d219", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870341, "uuid": "55204ea1-42a8-4779-afae-1e78382af85c", "value": "36B53D2491DC2FE05345EAADC725E6E8FE6A146F5802FF86C2B7145393E34EB6209743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870341, "uuid": "dcc772a1-08b7-480b-b91c-ca89460b7088", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870341, "uuid": "bd2278cd-c39d-4913-9736-8abb76c7841c", "value": "6144:e9tBZ91p7+uR1N+M23+s23NuveW8qtZmH6pJLdzQ+gEK1lLxEB1iq+YFDaW5tYgI:AtH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870341, "uuid": "1c7f9a4d-5732-4d78-b6dc-dc1968a040c7", "value": 2472168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870341, "uuid": "eed86600-8643-480f-986b-069d837ff286", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870341, "uuid": "3d4f9a72-2694-460a-88a1-e6fda6595362", "value": "DHL Shipping AWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb11b76d-bc69-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621844893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844893, "uuid": "b17101ce-a38b-4dcd-aa31-28d297331f4b", "comment": "Malware payload (AgentTesla)", "value": "311ee07d43437842a1f6536d029c822d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844893, "uuid": "9af63a53-6439-458a-ae60-f248651d4231", "comment": "Malware payload (AgentTesla)", "value": "4a33ccb09660326d4158898be2f17d43b3c94fc901ecd97d30d932421bb92023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844893, "uuid": "9baab954-fd2f-4b12-a029-91ee4fff9b1e", "comment": "Malware payload (AgentTesla)", "value": "abc49390a7aac6f4cd5e7e7f8659453219271e60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621844893, "uuid": "03bda386-3670-4d5f-8d41-23c88c7941d6", "comment": "Malware payload (AgentTesla)", "value": "9e5e405b259471645393df51e4aca94ecced220d744013092f2d1072ec1e8338510c1d0cf06ea733ee8d8084f70a8364", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844893, "uuid": "9d6f95bc-cdf3-4da5-8458-40b345426616", "value": "A544229B56C0C4B7E56A1B720EB3D277E335E7193419436F7B288FAE6D05187F04828A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844893, "uuid": "85fd9f53-7f75-416a-80d4-9924f9931d92", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844893, "uuid": "d56922cc-7963-4031-89c9-ff290fc12a38", "value": "6144:8sBmtlbJt7j6kxwqNiiJYn5re88Ljr0Cu9OD9T2152rX86sPxGBovAvuK0:FelbJBwqiiJY5reLggKArXM0BovPK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621844893, "uuid": "e731761b-4f11-4358-8ca5-f804d0ba975f", "value": 276420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621844893, "uuid": "78ceac55-400b-4cdd-8a23-580c51ddb1be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621844893, "uuid": "1a026473-5337-4b5b-8566-27ce611d4588", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e2ef36-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832486, "uuid": "e3ffc27e-d2f3-4060-b79d-536a440d7774", "comment": "Malware payload (Dridex)", "value": "caaa9f9fd6f6ec990a269385dd2f79d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832486, "uuid": "1202635f-f098-4ef0-918a-ffbaa0e4631c", "comment": "Malware payload (Dridex)", "value": "4abeda777c91eacf9114fc1e9e29deea7b8b8b1c94ec0637acbb9f2bc6db1997", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832486, "uuid": "bd273baa-a4f1-49bd-bd0c-d678e1bd0e64", "comment": "Malware payload (Dridex)", "value": "9794d9bdd2f080a4aa1434cc22dc29ab7a165600", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832486, "uuid": "c3e10c2d-f935-4476-ab53-15636c95e68a", "comment": "Malware payload (Dridex)", "value": "912cd816332eee4c853191b99c51bfb9b33d545bbb549c234686bd2192a0c9c62cac9b01810f748090caa2cce4769dde", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832486, "uuid": "804a1e07-262c-4122-b6e1-fc48c7c297d1", "value": "02F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832486, "uuid": "0b838a30-db8d-4160-a8a5-4bdf9350f772", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832486, "uuid": "ab02e83c-37ba-4bee-a4ed-584bc634638e", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832486, "uuid": "2da8d8ee-0a26-4412-88ae-17d9b06b5ea6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832486, "uuid": "d548f312-f5c3-4cd2-b70c-570bff6161ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832486, "uuid": "6b83137c-93db-4a9a-9ec2-99048c79a66c", "value": "caaa9f9f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc83887-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621878905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878905, "uuid": "8d458b27-ae8c-4a63-8cbb-f629979168f0", "comment": "Malware payload (RaccoonStealer)", "value": "6d5a75d673f414019114f6825eb18105", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878905, "uuid": "e130d406-7d96-4093-b23f-30b515d5b83f", "comment": "Malware payload (RaccoonStealer)", "value": "4b068e0c1cbb9e1f00e453203e28e4133e547dff2edae75d2c235b6436d3c2b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878905, "uuid": "e362b1b2-a2ea-4804-8bfe-adec6865a5a0", "comment": "Malware payload (RaccoonStealer)", "value": "1ab56cf1065d5151fb18e96e7faa3f765925e6a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878905, "uuid": "0313dfc1-d836-4422-b169-3efabe76cc25", "comment": "Malware payload (RaccoonStealer)", "value": "1b74bb6ff819714c5cdb0fa8f57e786ddbfb89601fd1c7d651123eab116a9f04813b1f058e48514003b1287087d9e0d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878905, "uuid": "36bf1c6f-6fa1-40e7-a551-ab64c6eb5585", "value": "ACC4D0216691D035F0FB12F44AB682B8683A7DB1AF3440DF72D53ADE56346E4AC3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878905, "uuid": "b1c4a342-544e-4960-b35c-fe125a620c34", "value": "23be1bb52b377f47a7913594f53f99c3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878905, "uuid": "a54b1d60-68bc-45c5-92d9-1a2784aa0bf5", "value": "12288:aNhuYiLd3SwdJ2RI+aCWQ2IJNJvjGSLf:3YRwOR6s5JNhhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878905, "uuid": "b5647e7e-4a50-4a9e-a139-cb7c5f4987a2", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878905, "uuid": "a8957d1a-9aca-4573-bfcc-7abb50aa3fd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878905, "uuid": "4625395f-d488-4020-809e-074ef2c2cf73", "value": "6d5a75d673f414019114f6825eb18105.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62afa86-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868480, "uuid": "a70ca964-cd04-4102-b7eb-fdce789d267e", "comment": "Malware payload (Dridex)", "value": "680a4070c61e981ff29d5738955a5dfb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868480, "uuid": "8d61df9e-5d4e-4bda-ae5b-1f0d32e2daea", "comment": "Malware payload (Dridex)", "value": "4bd52cf3a5e2ecc9dea0509817c52c6b7f67111f728833514337c7da3169ff3c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868480, "uuid": "47ec9d72-bec2-439a-9cbd-979222706a5b", "comment": "Malware payload (Dridex)", "value": "4082476bc751a001d96c8b2191098c69186e138d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868480, "uuid": "7f99e423-b226-40df-9a8b-f6f6ecfe160d", "comment": "Malware payload (Dridex)", "value": "ed50414c5783766d97491bcf5309b029e049e05643f0e660ab9292e8ced157401f5764955411c8975c0993e203b698cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868480, "uuid": "11e25de4-6b80-4e96-a147-1049a4c5f593", "value": "16F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868480, "uuid": "b20bba59-69bc-43bd-a701-574a607bd19b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868480, "uuid": "87ca873a-92f1-48e3-9275-a09e4562c225", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868480, "uuid": "c88c3dc9-7407-45a0-b1c0-676b02aff303", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868480, "uuid": "bd237c7c-9cc8-49f5-a199-eb7e1a709a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868480, "uuid": "16a8d8c8-9eb4-4d02-b781-52e0d8e1e312", "value": "680a4070_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea608a1-bc64-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621842483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842483, "uuid": "c410cfeb-eb3d-43eb-9d1a-b7433cee78ff", "comment": "Malware payload (AgentTesla)", "value": "4c33b0b5bc01bd47d80774cf130a4bb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842483, "uuid": "25e4dade-5e7b-45de-b2e4-a5f19b9c5ccc", "comment": "Malware payload (AgentTesla)", "value": "4c53bbc012d747135e1d8fff59a65200ca81376ef362f0ba5107795e5e8622c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842483, "uuid": "a376282a-8f70-4b57-be28-c0c163e612ce", "comment": "Malware payload (AgentTesla)", "value": "a6663aad65bf0c11bd60f20b3c694c71eb778c82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842483, "uuid": "ad1142bf-4c1d-4cc0-8898-0dcfbfec91a8", "comment": "Malware payload (AgentTesla)", "value": "68e86e7b71c7591d5479cc9faa0f134da724f40d124fdfe20e0281ea3088406392e7a003ad554a6d32138f230c4b6c71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842483, "uuid": "e787f152-af9a-4e89-b769-8aeb2d330cd5", "value": "0AB4232947EB9C2E52032149C1884CF6257C66DBFE8DC986CDC53AA67BA1C362707D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842483, "uuid": "defafd31-7026-48dd-9798-9f7739334c9c", "value": "12288:l+znl0nTsT73kOoY/7ind65yitvh1Im1H1H8Wx9wt:srynTup51r1tx9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621842483, "uuid": "86a8ae46-9996-495a-a2d3-6c0e692bed6d", "value": 506978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621842483, "uuid": "a0b358ef-eb27-48e5-846a-e989672f1cd8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842483, "uuid": "3b298f82-f1bc-418f-9329-10f8bb6c2e82", "value": "Dringende Zahlung.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083a7350-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1621878845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878845, "uuid": "9229274b-713e-4ff1-9cca-6102135b1de8", "comment": "Malware payload (ArkeiStealer)", "value": "1f38924a7e949659522f3bcd5257f8cf", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878845, "uuid": "9e064ad9-093d-4cf3-9756-c5dee1ee446c", "comment": "Malware payload (ArkeiStealer)", "value": "4d4cdc0c10068ecd654c95b68a0c2bd907b876fcbcc06b1144365340fb9a7151", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878845, "uuid": "414a54f3-6965-4a4a-97a0-b37ec5768311", "comment": "Malware payload (ArkeiStealer)", "value": "01e94faf977297f67d10fade2324d92b546d9fb9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878845, "uuid": "249eb318-a337-49c3-af18-582be3c52eaa", "comment": "Malware payload (ArkeiStealer)", "value": "2412c99f08c4544ec167c533ad291e1d19a36ba5033c7d33b8b4b6f3ca9e00b99c1467e9724f5f5805822a53d19c8305", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878845, "uuid": "69618c5f-fcb0-4bd7-8d54-86cdea74bc25", "value": "CBE4D020B7A0D035E1FF16B489B9C279652E7DA15B7090FF22D536EA0A345E4AE3134F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878845, "uuid": "58ce7fdc-becd-4221-8880-2c15df34f6d3", "value": "5e4af829e45903391dccafe97a3396f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878845, "uuid": "2ed6829e-6b4d-4f94-bf20-c674431e97af", "value": "12288:ARDyeHNNpqNAaDu9yz71gkL2kVkdcelkATID5mMAQG2BoyfF9taXsLj:AZNNMKyz77dkdcie5BoWyXsLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878845, "uuid": "bb323e9e-5878-4fd1-8e55-fdfe29a3b787", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878845, "uuid": "bde45154-1087-4c83-b63c-9750a2debec0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878845, "uuid": "763a9356-adab-45e4-a744-3f98465849f0", "value": "1f38924a7e949659522f3bcd5257f8cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376324cf-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872911, "uuid": "b3acbdd4-201b-4ce7-926f-1126444ae65e", "comment": "Malware payload (Formbook)", "value": "05d5a8661b824662a4e21814cd0e77f9", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872911, "uuid": "31859988-7928-4eec-aeb7-d3dc872224ca", "comment": "Malware payload (Formbook)", "value": "4d802d9e6ca2715f9181c8a3314dee02ef95901049bdc955e1b0a66eee2186d4", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872911, "uuid": "e5373406-cd1c-40f4-b593-c6a5534a18fe", "comment": "Malware payload (Formbook)", "value": "5fbd48907236e776f6125f66fab6b34c3ced6403", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872911, "uuid": "cc31d0f6-789f-4718-b809-247ee500d6e9", "comment": "Malware payload (Formbook)", "value": "5ecdf7761c4919259144f683a0f257a06664a9c3fbe1ea03724c1b747118f509fe2cbd5bc3f8814c0c5601700d23f191", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872911, "uuid": "a72d7d9f-6d30-4b4e-904b-c01d17e503e4", "value": "95A4CF5C33A4749EC567CE768AB41C20EA21B477A32BD34BA053259D9D0E6DACF107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872911, "uuid": "373b4b76-a44d-4f7b-8033-474f98e449ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872911, "uuid": "396db2ee-76a0-4d9e-abfa-af86ecf3a6e8", "value": "12288:BymWk49uNXk61nJLWEVf3OKwLbpT0YdRi/JWM0hR:Em9NXkunJLZVf3OKw5T0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872911, "uuid": "b14d3d8f-4a9e-4a33-8873-b5e7824aa9b7", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872911, "uuid": "ced67206-923a-4fdc-8210-ae99e9b49651", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872911, "uuid": "f75ac794-d591-406f-960e-256d5d2aae6f", "value": "Copia de confirmaci\u00f3n aprobada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a478fc34-bc5b-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1621838735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838735, "uuid": "c4daceca-bc53-46b0-a1a3-2fb71fadebb7", "comment": "Malware payload (OskiStealer)", "value": "ed126806c975b9b3f791a2089d0563ff", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838735, "uuid": "c1e2a4c4-8c60-4117-926a-cd1dc5b49d05", "comment": "Malware payload (OskiStealer)", "value": "4d8ba73ed30f7beddaefb592e4e88cb5ffe2fbf2ae1c204b45ae86a41b3fe5db", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838735, "uuid": "270dbe43-04fa-442e-b63b-c9e24dbe7a02", "comment": "Malware payload (OskiStealer)", "value": "9a38ba3494716a752a06bfe4d0ba2c599e9d37a1", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838735, "uuid": "edc228bb-b219-4689-a8fb-ede34a1acfd7", "comment": "Malware payload (OskiStealer)", "value": "f238e75a61ce184c5057a3a184ecfa8783110bac21664fc78b6301abd6ab7508dc938348f8e8a03d3210fedae60285cf", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838735, "uuid": "45df060b-eff5-4cc9-9a5d-1cf2f3471f52", "value": "23D42316D422D6EC954DC2BF9B6E001A77AB7FC3858E60471681F8D47D197CC20DBA8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838735, "uuid": "385a4014-fd19-41dd-8969-28db590b8963", "value": "12288:r60U1lhCtnHamHjBapB7aAeP5o3Wtx5F3dOZ+zRJDFOpeu:+GnDjBEB7r3W35F7HpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838735, "uuid": "e30bbf7b-dc0c-47b6-854c-61f57818f887", "value": 623579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838735, "uuid": "58d5b117-8861-4735-a081-d928273367d0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838735, "uuid": "e4c02b19-94f9-49d5-9561-d580a0ba1e23", "value": "PO DP-06419.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc2ad6a-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857675, "uuid": "89426e7d-a45e-4c48-a924-c5592c209625", "comment": "Malware payload (Dridex)", "value": "65d0d4f410bee2529e0cfdab7bc66c7b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857675, "uuid": "633705aa-6a96-42c8-b40b-740f7b64a84a", "comment": "Malware payload (Dridex)", "value": "4d982a51528579f8920ebcb0033cb6951bcf95ce2bbb5c42ab5506335e12cebe", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857675, "uuid": "255025ba-1002-4de4-b5f0-6abef2cb504c", "comment": "Malware payload (Dridex)", "value": "3ff59fd89ecd90b13accb3110dd6a7d8fed36bd7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857675, "uuid": "dfbb61bf-c552-4f34-913e-9fd436894922", "comment": "Malware payload (Dridex)", "value": "89b6e19e6cdb57130c473f4926de9654f71ac1e37caf09b93822324b6e323961a46036c68c2201e248bd6ecb37e762a2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857675, "uuid": "7901f1ef-4a5a-42e2-b38c-9d491dcf9d83", "value": "B3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857675, "uuid": "3b07efef-e165-48c6-bf31-5fdbf546cbec", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857675, "uuid": "0810eb44-2450-4891-99c6-62d23ffcd6fa", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857675, "uuid": "b08c799f-735e-4829-8403-93411f7aca25", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857675, "uuid": "4c58360e-35a7-4b04-83e3-9569dff4a955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857675, "uuid": "4c537db5-959d-4377-bdbe-c42df78260f1", "value": "65d0d4f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ef8e3e-bc91-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621862029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621862029, "uuid": "3181dbc2-bc44-413f-ac6e-77d0b55920f3", "comment": "Malware payload (Formbook)", "value": "18d071af176d03b7611afe4d60b9cac9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621862029, "uuid": "ae0692a4-7215-466c-976c-cbe83c19b485", "comment": "Malware payload (Formbook)", "value": "4da679e366dc987277f7850f71d5343e7c9b8cff4b2df89dd2f335f512de62c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621862029, "uuid": "823a481e-c4b5-4b8a-8309-1b393e921e3e", "comment": "Malware payload (Formbook)", "value": "ae04a776afb96ba6da6a5928b299ff24a28a3ea3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621862029, "uuid": "93aa9925-e99d-4695-a883-11283aa4efa6", "comment": "Malware payload (Formbook)", "value": "c91bc37bb5c654aa9577b866307983cd13c0dfd8693c7dca1e926a74f4d01594ba6e5916932652d98fd5657628e2b94a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621862029, "uuid": "d67ef770-c3b5-4450-be69-1adfc1b4349f", "value": "563516DC5E5AB51AC06DD27431D040BFD353DF3320B9AAA69AC3EBC95717E4078812AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621862029, "uuid": "7eb7cf98-8be2-4966-b3b0-77816234f7f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621862029, "uuid": "8bd2b911-55f9-443d-8f40-3aaf9cffae1c", "value": "24576:lnNBynk0jsvVEmd3zXpYH1VRdyzqa/VeCfLc:dqjsntOH1VbaNLLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621862029, "uuid": "e6039921-f500-4a62-856e-d08b482dc393", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621862029, "uuid": "b97a4853-c910-4da4-9277-29dcc25a684e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621862029, "uuid": "2e34cfe9-93cc-44ff-a8ed-3bf10f022dca", "value": "netwire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb68e93-bc9a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621865757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865757, "uuid": "a10c8210-ae85-45d3-a1c2-311a6f64685d", "comment": "Malware payload (AgentTesla)", "value": "e88838129670c137fb7d4cc12362156b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865757, "uuid": "4aa0b0c8-a840-4129-995b-5a3dbc42ea2a", "comment": "Malware payload (AgentTesla)", "value": "4db148b755b23786d900184cbaa5a8c84943b34270186638aaf29933a2b1b6ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865757, "uuid": "223265d6-8e44-4416-ad53-a5d0d6164e12", "comment": "Malware payload (AgentTesla)", "value": "ba40e3b1d1771c0a5ff7332403fed95f1bbe9555", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865757, "uuid": "e1ace5b0-425f-42ec-ae1c-fd5b5aaac148", "comment": "Malware payload (AgentTesla)", "value": "3b168b57592717d70b915d4dc53d749a8b43377a265833ec89c89ab8dc19759f5e0d605e2b2142193865eb4acf47fe86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865757, "uuid": "09101624-31d5-4504-b8e0-97fd1018ad2d", "value": "D7D4E0292368DE54D2BF477D9026027283F0E1168543F75D2EC560FABDB3762CA722E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865757, "uuid": "815e19f1-adbe-4ec9-8f30-dcbe5e9183ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865757, "uuid": "714365cd-13a5-4458-ae27-4a999bf8ec7b", "value": "12288:cZwCjrhy3QCKSbqoPuKzbE6voCo/1FAVJK0dBmJ2VkuYK5g5xrDvXGciJM:kwCjrhy3QC9q2zbR2oK0TNV7YJPvW/JM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865757, "uuid": "52a95a01-b1c1-4a70-9de8-625f6337bb4e", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865757, "uuid": "2507ed21-a00b-411c-8e14-b6654d190887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865757, "uuid": "60d4e1ac-a6fe-46e5-8678-2e067e9cf8e3", "value": "AWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f0b7c-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843360, "uuid": "1c6f35dd-e9ee-40c7-83e9-863594ebb68f", "comment": "Malware payload (Dridex)", "value": "fd331123793045181f6fc17b16efe023", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843360, "uuid": "d9413c3b-dc29-47a0-ae4b-18dbb0cb8c05", "comment": "Malware payload (Dridex)", "value": "4e35efe835f73e543e73751c5929ad5ab27364a0900d843bf5988df1ccc00599", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843360, "uuid": "26ef8d54-1c8d-4ed5-b7d9-4e87969a10d8", "comment": "Malware payload (Dridex)", "value": "78b0b78f763d8268a6c453a4b504c69c9bd4dee2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843360, "uuid": "90a0d58e-2a85-47e7-bd42-b64bc7087640", "comment": "Malware payload (Dridex)", "value": "a815db1ae23dfc43e85a2e63bc3059f52530744ab8fbd3dd9f1f56d77f076fc8f2147007190c0be0199744d91f2ff15c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843360, "uuid": "3653c427-3eee-47cd-b6ed-1474708756eb", "value": "1AF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843360, "uuid": "890b9378-90e4-4c7e-b966-e7dfb5247386", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843360, "uuid": "0c776839-9df5-486c-aacb-722b421c753f", "value": "3072:FA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:F3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843360, "uuid": "e8ee8c34-be17-460d-9210-15a2b5b10886", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843360, "uuid": "f31e3068-6e1d-46eb-b557-faf1c72c0075", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843360, "uuid": "11833d66-8b2a-46e4-9f6e-d292df919d3e", "value": "fd331123_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b62f37-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871432, "uuid": "58e9b9a0-5de9-477f-a1ae-a9460d964802", "comment": "Malware payload (AgentTesla)", "value": "90ac7976728563406b5583e82ec842e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871432, "uuid": "2ca67835-5218-42c3-b298-12f91ab2a5bb", "comment": "Malware payload (AgentTesla)", "value": "4e48531db248b7df3ed8cdfb40b01fd0b9864d0abbaca250d0d83bd865b14c77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871432, "uuid": "33c8f0bd-f213-452f-a763-f8537616c4db", "comment": "Malware payload (AgentTesla)", "value": "22d5afb8d7dd64298d427700df94004902182691", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871432, "uuid": "c1663e54-109a-41b0-8e5f-0ef3596d6198", "comment": "Malware payload (AgentTesla)", "value": "120b49aaac242bff2cc95f6a4df0950e59ca7e733fe9fb7f0d7c0a988aa26321c7891fb4b918fc6358af0698a7d00ffb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871432, "uuid": "b1f7bfd0-0e75-4143-8f66-38264c089709", "value": "F4159E1C106EF322C198D2798AE4C62BE951EB377031BD1AFCD72798075AF41799227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871432, "uuid": "850ff12d-8e80-47c1-8d87-88b653159726", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871432, "uuid": "3916fb83-6e4f-41fd-8e43-2555fd6ccf2c", "value": "12288:32HhBC/YkC6hX3zM9ck6MLW/S/ke+On0GNDCDr1dPP4Dubgte9d7:WhBC/zC2XM6MMuk4lDCDrjiC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871432, "uuid": "fa6f9c31-053d-4572-8c22-0f07909ee782", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871432, "uuid": "23f7f209-f8dc-4207-9c9d-8c5823135f3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871432, "uuid": "5f5708c1-f9ec-4310-87cc-90fa91ea1cc0", "value": "Paymentconfirmation24052021001245768abjjhhkizip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54a4b40-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1621872264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872264, "uuid": "a284d18a-07d9-4026-9aef-44ab09a933f6", "comment": "Malware payload (GuLoader)", "value": "82d463dc1d557702c62b01bcc360c80c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872264, "uuid": "ff603d46-1154-426b-accd-446024f9591a", "comment": "Malware payload (GuLoader)", "value": "4e4918945cfdbd65f76fcd903310782b77d9225fdfe5f0148eca44350a9a463b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872264, "uuid": "c5020464-d471-4d8f-84c9-fb9261593a46", "comment": "Malware payload (GuLoader)", "value": "8971eee64271b5862be059e56a9f4de00d410ec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872264, "uuid": "23eeb955-c6eb-405f-9d23-64ab9763f55a", "comment": "Malware payload (GuLoader)", "value": "46e73d339ab262f8e5b3ab6cc9690c202da5064800fbde4716d91ef76f61db1da572ee6ecdfc7e9f8aeab1ec2896009f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872264, "uuid": "34256604-6e1e-4e65-acfc-ddb25dce67ec", "value": "6844B5B39E20E8CCEC2AC93C572F86138A20F8E5A53F1A36B593478DF665D525607317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872264, "uuid": "53b7aea2-623d-438f-bfd2-c20359825de5", "value": "55a503a3bd20df6ca8e85e03331a4fd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872264, "uuid": "f8106d3b-ccd2-4f3b-a01a-436b4519fb8a", "value": "1536:LopQV20MCIioVG+g+yI50UyN3AhnV2QU2zhGSCjN9c2UasKDfDmmneDm:LzVnoVG+gxNoV2QUNjNZkKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872264, "uuid": "e0b03ebc-f276-41ac-a910-2ac43f11d916", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872264, "uuid": "d650730a-9a76-44a8-8734-f523de376349", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872264, "uuid": "43a686f9-e1d9-43ce-9daa-b894d790dadd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afbaa82-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868649, "uuid": "88f9c794-9469-4458-933f-ba4686aed247", "comment": "Malware payload (Dridex)", "value": "89aa52190dc54260aee19b4c48b12866", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868649, "uuid": "3a57efcf-3c10-4803-a86e-8d81390d8255", "comment": "Malware payload (Dridex)", "value": "4e93262d51e89979630f4461da6718a8cd823e00d7139bc09de774f5f16296f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868649, "uuid": "924fe8fd-3b07-4047-ac09-e476f3b62f58", "comment": "Malware payload (Dridex)", "value": "e1904fa6250a54ae8750cf2c81a5563472b608a4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868649, "uuid": "da427364-f37a-47f4-b31d-edf2205976e0", "comment": "Malware payload (Dridex)", "value": "59a224967118f45e962cd7cf4960f3a709cedab27ce4559b30a4d6a46a1987cdc807862e0b86a2b7d1c52492c5794c28", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868649, "uuid": "df97b150-a1f2-424e-a9cd-08c9924070b0", "value": "35F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868649, "uuid": "d22eed08-55c3-494f-ab7b-594d2d2795d6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868649, "uuid": "7b2ff446-ae77-4dca-a3f3-5a910c5282bd", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868649, "uuid": "a8254795-5f32-4621-a6e8-42320cf6e8b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868649, "uuid": "9774c2b2-debb-4ea6-b19f-5437356fda79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868649, "uuid": "b2bd07c3-395f-4ce5-ac6e-b9db422aa1e5", "value": "89aa5219_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dea3477-bc26-11eb-875b-42010a9c0053", "comment": "Malware payload (RedXOR)", "timestamp": 1621815746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815746, "uuid": "9c482654-107c-4e3e-8969-ce7caa4c5d7a", "comment": "Malware payload (RedXOR)", "value": "e35bcfc1b7c148650c55d8969abb378c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815746, "uuid": "124a5dfe-b60c-422c-9472-dc95592cc8f6", "comment": "Malware payload (RedXOR)", "value": "4f159f6a745752e3211ca1146830c86075fd8f5db60f704605a57db904dcf5c5", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815746, "uuid": "5324bd53-59a5-424a-8507-91675c8f7053", "comment": "Malware payload (RedXOR)", "value": "b2d16fe2fdc74875c52a5d7752326a4ab6179160", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815746, "uuid": "19746734-b261-4c74-a5ca-35442fa85a69", "comment": "Malware payload (RedXOR)", "value": "c56a06fb919c16dde3f43110527d932498ebb716c26154cb27e30b9160824873229a7d825ee8c994faed65194ceceecc", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621815746, "uuid": "5687e160-272e-4961-be18-072eed27685f", "value": "E033C61BA626C97EC0D5F5740FDB8AA0A0E274F44F36714B32011BB76D927A40F1E76A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621815746, "uuid": "1e516fcf-f491-4aa0-a98b-c74fdfc7ad43", "value": "768:ywbjcMw77sDM+OMUr81HaK3zhhXGJ4J2LpIRn6ICqT8IFNca/yvZYy:ywFwHdHm6knWJ4J2qRn6ICqoIFB/mYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621815746, "uuid": "4c453230-dd47-4dd8-ae3d-35681b093175", "value": 53901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621815746, "uuid": "ce41d87a-0e4b-49db-8767-0f582c943c11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621815746, "uuid": "82d601ba-8b31-4031-842c-5ad2ae332cf3", "value": "4f159f6a745752e3211ca1146830c86075fd8f5db60f704605a57db904dcf5c5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd03ac5-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621886639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886639, "uuid": "273bb27f-0df0-4e6e-95be-b7d1b29f1b3c", "comment": "Malware payload", "value": "5a1da38f4888cf055fd12e68d587bd50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886639, "uuid": "6e57f34a-e709-4b03-addc-e5f55ed959ec", "comment": "Malware payload", "value": "4f59e3978171d536664a6fc022042b558c5f47352c195c36a2914e2b07aa08af", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886639, "uuid": "2fe662a0-d835-4e5e-ba07-79cabe0cc625", "comment": "Malware payload", "value": "30aef72231a5e1411f0c91f8c4790389645b7067", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886639, "uuid": "89fd4ed9-cfbc-4fe9-bfe2-2a7fa5f88348", "comment": "Malware payload", "value": "2b9791f3fab0906efd6b354c6233da8e41fdd50508117ceabc1b2f47c38c3d97ef33cd22812413d583d1f3d48018e0cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886639, "uuid": "c806ed58-9af3-4a59-917c-8e8e14db68fe", "value": "E3F5007CFFCD70F280592693AB16400BACA07E431225C877EDCB3E86CA893D4D2B5488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886639, "uuid": "56f615de-d151-48d4-aadc-939e7887d7fc", "value": "48:0bOyT+QdhTTYNtScT0LDcUT/cTTTT0/cw/Xf5cTT0cw/cTTTTQ/cTTT0cTTTTTwo:wOyCYTYN9VKdkxjT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886639, "uuid": "75591c97-b494-42a2-8f1a-995cfaa23921", "value": 3548936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886639, "uuid": "b6d27474-f837-4efe-ade9-444151dca601", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886639, "uuid": "f277e724-736c-42da-a96c-84063a120084", "value": "5a1da38f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c07ce6-bc9c-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621866439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866439, "uuid": "38f0d243-bb48-435e-8e73-e60e24207d64", "comment": "Malware payload (AsyncRAT)", "value": "fe46c193a26cdaedadd6ee2957df3e12", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866439, "uuid": "98501fd4-d549-4e5f-8e0f-79c8edf8697b", "comment": "Malware payload (AsyncRAT)", "value": "4f7e6260b30d732b40936166544b75d8ff162f9c75c73d1f7cd37a7e0d3189d0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866439, "uuid": "c28f936c-8130-48fa-bc4c-4ffa9cc15806", "comment": "Malware payload (AsyncRAT)", "value": "3817bf5531ae654121ab63932bc29394c8e17ff2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866439, "uuid": "bec9cf7a-4530-4ea0-bd0e-545681a02c8b", "comment": "Malware payload (AsyncRAT)", "value": "66408aba69e78a38cbf23a5a88f1c07b65a37b629331648fa7cd5e9f7db7e67186be97bee34dfb029487146992be623d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866439, "uuid": "ed41f26d-f36b-4f9d-aaf7-645b386ad700", "value": "4D24E64262BC4CF7F8EC3DF696A393684A615C868D31C105D9AF38E5F973683C9026D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866439, "uuid": "23851ea6-40f9-4209-971f-52309b1901c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866439, "uuid": "6afec95b-aefb-49f5-bd52-257bdad6cba1", "value": "1536:t2++NCOmzbSP+Q+SMkJKQwcHKyauq22ZYXVclN:k++NCOmzbSP52RQwcHKyauXNFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621866439, "uuid": "1a85092b-f745-4100-b3df-acacb18b1a12", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621866439, "uuid": "35dd9a9e-8310-4140-a223-da8c7ddfa6d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866439, "uuid": "0daea85e-1eba-4173-af81-6b7932df5189", "value": "TNT AWB N0 - 6278216733.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a63641f-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843281, "uuid": "3197ed84-94f3-4440-a07e-051a23293be1", "comment": "Malware payload (Dridex)", "value": "3207e3186452badd523c8e91bf07249a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843281, "uuid": "9f79440d-6b65-436d-801f-504f06ec125c", "comment": "Malware payload (Dridex)", "value": "4fd5e728e309d48e2d29cbffb6661647fcfb36cbb33b30d730f56f1473290548", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843281, "uuid": "b86b9ab3-b24f-4659-acb6-cc4be0beabc2", "comment": "Malware payload (Dridex)", "value": "a122e035a6eb40561a4df3efd373e28f1983a14b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843281, "uuid": "8e1c7bca-a56a-46e5-a91c-05f020efcdeb", "comment": "Malware payload (Dridex)", "value": "2a19bb444e985eee56196760c6a52011375c2be7bc2d0be149846864b1bd6dcba7f2eba9745c0c8fd33aa68bdb56be06", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843281, "uuid": "1a9f132a-0972-456e-874b-cd55f55fd043", "value": "1DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843281, "uuid": "7ab6523c-b1c6-409c-9e49-620bfb8e4ff8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843281, "uuid": "bfb4287d-64ca-40c1-8043-4a7262265dbc", "value": "3072:siFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:PeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843281, "uuid": "70c143d1-bf53-4ea3-9724-1119573b2248", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843281, "uuid": "e8752bef-8d81-42e2-bf17-72d4cf50d070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843281, "uuid": "85e5729a-a14f-4147-9832-7242f5cfc97a", "value": "3207e318_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2d2fb9-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621857726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857726, "uuid": "e6d9a5c7-87f1-4458-8354-8331b3a45c9c", "comment": "Malware payload (AsyncRAT)", "value": "18c79e07e59654e2c37f522eba6e583d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857726, "uuid": "d816d806-d492-418d-8a0a-07d54bf9f5c3", "comment": "Malware payload (AsyncRAT)", "value": "500e273251a6dc2c9a29a23ebd44add1c2acb922d406216bbf898d240e6997b1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857726, "uuid": "4f741af0-0ddc-4019-a636-03a749175826", "comment": "Malware payload (AsyncRAT)", "value": "60d7158bc379d320c35b0b315e50a9dbf9461fcf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857726, "uuid": "1ed346b8-eeb1-4980-8e5d-1d4dd515703f", "comment": "Malware payload (AsyncRAT)", "value": "ed687d7986f8f72be42d732d4e6e6d2d16838b6d2a8b686adf637c62fa95786d9770b33afd317c2caaf04339b9345261", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857726, "uuid": "cb08422f-4661-40ea-93a0-181c4388809a", "value": "AB83121D8CAFD681E7297B9C83C7A2B7E1E4A2E4938376BB0F874D468016501CC7D1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857726, "uuid": "a43bfd60-8464-43e2-88b5-29572df6d8c9", "value": "1536:divb6gHEevLsKqa8sdfCl+tDcws4f93g1f1oxGLroxmtEi4+YaX4jBU:d0ugH3zsta8UO+ff9w1f66DXUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857726, "uuid": "1f04d5b8-ae33-41ab-be35-37ff31d11cf9", "value": 87364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857726, "uuid": "10556918-ced8-4491-8651-09eafedaed0a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857726, "uuid": "03fc49c2-4746-486d-ae00-e58c879c0023", "value": "18c79e07_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9d5715-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621837864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837864, "uuid": "0d0bf298-94eb-40f7-9581-2e414d084da7", "comment": "Malware payload (AgentTesla)", "value": "64db8aa6133492a118fc5e079e7d1882", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837864, "uuid": "6b312e52-f84d-4a4d-8326-2cf49270d049", "comment": "Malware payload (AgentTesla)", "value": "5036adaf8f2c82fb66f9c3604ec816f386a0f786a77faaeb35c56d92c6ab8ecb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837864, "uuid": "70e77eef-3464-40e8-9e9b-0cbec125e0ab", "comment": "Malware payload (AgentTesla)", "value": "f770d30860d78c4de91dcfaf2af4f4dc26590d87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837864, "uuid": "9feeea74-4f69-4c1c-9e9f-91739145aa33", "comment": "Malware payload (AgentTesla)", "value": "f2ce03b6b666c04284a40d08610e3221d1e007799c69d431d84434fcb6e899af55652edf5112580466743495350a713e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837864, "uuid": "c95b9384-5787-4c8c-8dcc-0512a972bc26", "value": "F9A423EB7931D5277B00BDE257AFF81B50B3D81D512F3A96A0A0EB45A2A02F60519C63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837864, "uuid": "6969035d-5c6b-4c99-a29a-9895a29ce2bf", "value": "6144:ksy5MwyuerfP5raX6+niEMLl0+nezlVxfkxx63/tlvTk1hgL7ZGCcUxGCUy3yVTS:m5zerJi6+LMteBV9dmYZQu3UTY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837864, "uuid": "6cb71c9d-ab1c-45f0-9c17-9a73217d221b", "value": 482281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837864, "uuid": "c3f8926f-3765-4d3d-9bfb-b42b5cd4d2fa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837864, "uuid": "5f53b896-fd4e-424a-ae09-bb14008e9bd9", "value": "DOC.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd77a086-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872277, "uuid": "b13eef66-344c-49cf-b978-0b6cf591e3b3", "comment": "Malware payload (AgentTesla)", "value": "c43ff70c1a60486bda3a8f005e5bf26f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872277, "uuid": "3171d00d-1964-49b3-9be5-da27c51373ab", "comment": "Malware payload (AgentTesla)", "value": "5037540d95fb47791a0f0c3b4442c3d652ada9f160cae3a9614079d796ebfffe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872277, "uuid": "16e66411-72d5-443b-acf2-f98bac2c0839", "comment": "Malware payload (AgentTesla)", "value": "a69fe6a8a094962d48f12588b2a517b1e6424399", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872277, "uuid": "8e832028-4995-4679-9eec-87d7f5d5eee8", "comment": "Malware payload (AgentTesla)", "value": "fa900c69c262ca6be6638bcaf78a53575fa710bdc090ab419229ece8ed1503d044c39026ba86efb836dd872166197858", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872277, "uuid": "1b2c2df2-6fd9-4f40-8c06-9c9e41209473", "value": "41E4BEE956889A00C07F46F98C16C32033EDBD2E855BD6197ADBF1ED9C636538D23293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872277, "uuid": "38667550-992b-4d2e-b262-124782d262be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872277, "uuid": "2af81a2e-210d-43a6-96d2-5304bb9f2ebf", "value": "12288:QxwCjrhy3QCYf6MNKzh9WhG/1acwI8llWTCPiiFDHm8olf+x:QwCjrhy3QCY0zhmGdajWTCPiiFDHQlf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872277, "uuid": "1c987e48-a20c-4948-b11a-9f8f135817a0", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872277, "uuid": "d990a7b1-c00d-45b4-8194-53203d8fab69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872277, "uuid": "5624c50a-8caf-455e-9eb0-1a407e2e6839", "value": "c43ff70c1a60486bda3a8f005e5bf26f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac96468a-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836171, "uuid": "7792d687-678f-4265-b92d-4c68d7117837", "comment": "Malware payload (Dridex)", "value": "83f35ca59befa4009416e622c5442400", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836171, "uuid": "ffbb893d-5a65-4330-936e-859427c72573", "comment": "Malware payload (Dridex)", "value": "503bdac3b50550be0f7e1caeb7e187cc17835e41e082c816a9b976caeb34244a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836171, "uuid": "745111fa-6c8b-4ab9-bfa3-640625d42431", "comment": "Malware payload (Dridex)", "value": "d842fdf655bd6c721033afd524edd6631bb57f9a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836171, "uuid": "58922637-3f52-42f9-9bb5-fe7b9714d0df", "comment": "Malware payload (Dridex)", "value": "ed885a527a44070ea53cea8ffb37e4cf488c065568af49d97b9beccb5d3fb4c0bdb6e0459b62b57f32c02261074581ba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836171, "uuid": "1c8e40fb-b72a-431e-a105-f879efab14dd", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836171, "uuid": "10751d53-78d2-41eb-aebd-6190a278875c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836171, "uuid": "7394c698-d16f-45c1-b803-08c08396bbf4", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836171, "uuid": "ea10c167-d546-45ab-97a7-c5ad0203eec4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836171, "uuid": "407444e7-2611-4323-89fa-0a61f6e9b528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836171, "uuid": "cdf5a250-11cd-4807-aa65-554c1bf9b243", "value": "83f35ca5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fcc5b5-bc51-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621834355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834355, "uuid": "16ef3b8b-ba14-4af9-b4cb-4a2d7a7921ab", "comment": "Malware payload", "value": "7af8bffef7f7fb2ef45f8a5535f5af19", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834355, "uuid": "09878279-da8d-451b-813d-6fb463f13d20", "comment": "Malware payload", "value": "505f5b8d4970daa49a6a1a643312f4b3123863ec74d570c1ae740e2f1838e41f", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834355, "uuid": "7e82ad3d-a04d-4b97-9903-0de893f2bc57", "comment": "Malware payload", "value": "8fe13ed233fd3c9ef62bb9295978cef1b3c60e2e", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834355, "uuid": "495652c5-6e94-46de-b5e2-1548bfea520a", "comment": "Malware payload", "value": "0a0f945cb8545c136660b582af421dc745f9c88ae1dee4045e89774a886d28d17ab2851c608e65079aaa5522c54e3418", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834355, "uuid": "b3661c76-2fed-4fe2-b3c2-2ec54e92c59e", "value": "F64423344E998E0783BCA096B6D92558E4F09ED43407664AC7DC3399C6ACF480BDDDEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834355, "uuid": "cc08ca28-3bd5-435d-8439-816f2c5de5aa", "value": "6144:eCa6QuU33KqbvuOIa805uTA4iBGaiF5QYWsAtSbos:JDu3KOKWYKGaefqSbos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834355, "uuid": "febd3d20-c1d6-4b05-a325-85dcf4d53ae8", "value": 258354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834355, "uuid": "673cbe06-1f0f-4115-817f-917e76e011c7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834355, "uuid": "5dee8466-96f7-4bd3-ad89-78613e1da740", "value": "INV_no 201100039.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745860ae-bc64-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621842519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842519, "uuid": "4248d639-5f04-4622-bc82-67888de14bd1", "comment": "Malware payload (AgentTesla)", "value": "1ee311e9158073d00d09e353e8ded248", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842519, "uuid": "c9dc87d5-e964-405b-b2f5-41f46db3472c", "comment": "Malware payload (AgentTesla)", "value": "5076bfd0049f680c4b6c713c72bc4e7ba8872d469140773a9c537ef76848bf9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842519, "uuid": "c1ec386d-415e-4c66-9235-f3be654248b1", "comment": "Malware payload (AgentTesla)", "value": "343a082cd6b68971de49b5ad4d5ea65854db470d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842519, "uuid": "e6ec1082-0735-4f08-b820-dc71b08d4af4", "comment": "Malware payload (AgentTesla)", "value": "adbdafa9c5ca5a9a458190ce63e32108aeb1d789eeb8841d18879574f35afe4b87c10909ce81f89c4fa66049033535bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842519, "uuid": "82be0165-a917-4560-821a-c79f7f084466", "value": "E7F5FD245EBF9639C7FDC7965D004A10AE0BBD82A831D3D2A365022D076BC524DEBFB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842519, "uuid": "71e3e787-8d9f-4b9c-ac87-947dea86d2b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842519, "uuid": "8fb3a717-3748-4ac6-b4b4-3730dee70916", "value": "768:1HETKfSZuxLFJImSvLwfOk7oKq0mZxcDaXZc3KXZ2szSAF13sl1ohT0PbRhcDJkR:Fboe7NGHrehVO5AOUaYviQUo8Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621842519, "uuid": "3fb12698-30af-4d5a-b1d4-d2dcb560f775", "value": 3462144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621842519, "uuid": "0ddd4070-af3b-421e-9c0e-01b9dec9fb17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842519, "uuid": "498f0100-a486-44ad-9bd4-6dfaadf9d883", "value": "Dringende Zahlung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c072c72d-bc31-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621820743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820743, "uuid": "41b4e3bc-63b2-46be-88e4-137c8b09500b", "comment": "Malware payload (Loki)", "value": "e311c3e562cf7bfa2e37e05f13d9cbd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820743, "uuid": "d8cdc450-6652-4540-891d-daa00d0e3ef2", "comment": "Malware payload (Loki)", "value": "5076ea64aca3dac6ed1b1adb2c44a4e2a38b6da2f35769bdb3676d9ba38e2308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820743, "uuid": "b7b314e4-e602-4d52-b7e1-1fd425e9bafc", "comment": "Malware payload (Loki)", "value": "3c5b28c41d9e2bbf93395a18d03593137a0d0181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621820743, "uuid": "75420ed8-c646-49e1-b574-60619527f4c4", "comment": "Malware payload (Loki)", "value": "597cde38fe96cdbd66e08561a82755318648e2978e98b31927dba604cf2161b9d67ad6f249093e4e1c7c7466c13278cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820743, "uuid": "71f6a347-4d2d-4f37-966a-ffdc6291340f", "value": "9294CF6D77A0B59FC463DA72CEB42C209A31B477972BD34B6003219C5A4E6DACE117B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820743, "uuid": "6c9822a2-fdf7-4d4b-bf57-0d49e9fd32a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820743, "uuid": "9823c8b0-b05c-4abc-be2b-3f41b787052c", "value": "12288:zzp8Beps0hAJfaFthnQulQC3XPtkztNgS0z6+eA7f5KhxY:aeps0hA4FthnQulQ2XiAB64/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621820743, "uuid": "de6017ca-a72e-453f-b9d8-24257625f0c2", "value": 428544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621820743, "uuid": "a8e67365-57d5-4e3b-bed1-1d2f95f5a3c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621820743, "uuid": "e9a5bbf1-8774-4864-ae9e-5ea7e042460d", "value": "9046- PA118- SUPPLY & INSTALLATION OF EQUIPME.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6332cb-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621870584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870584, "uuid": "42dd5dc0-e822-4cfb-9ca6-584b010fbb03", "comment": "Malware payload (Formbook)", "value": "8f80426cec76e7c9573a9c58072399af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870584, "uuid": "47cd0263-fc12-4a44-a68d-d81647b75399", "comment": "Malware payload (Formbook)", "value": "507dbfd6aa22a40c64e153af688a18c03616e3473eee95f5312f6e9b2b3beb5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870584, "uuid": "f1544d97-9e7b-4e52-bedc-22c5832a3b49", "comment": "Malware payload (Formbook)", "value": "ed10bf7cf96b55461ddf28ff4ea5dd19f7685579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870584, "uuid": "aa74d8ab-ebc3-4ea8-b7db-310d0e3115bc", "comment": "Malware payload (Formbook)", "value": "5ff025fdec0463839442bbfec8060c4dcd30ce0ecea2f960a04f348181efe00c23afc3d0e598e30ab8e99fdda07dbe8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870584, "uuid": "3c3e4463-ab8d-40ea-8ea7-43c6c1a5251d", "value": "A734125731C8EAABE0D5573A0466232BCFF797019B06206F6FB00F2F63722C6D855256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870584, "uuid": "3c72fa5d-be04-45bb-a971-49bac72a8816", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870584, "uuid": "d021cb42-055e-427b-b0b0-c43f8c46efb3", "value": "6144:8sBi42D91vUlwSTRO+5Da/B/aHksyRYpnkucxd:Fi40vM3FO+Gm1Guid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870584, "uuid": "ce5366c0-9b8e-4eb0-bc77-0bd785a27e10", "value": 237460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870584, "uuid": "af42de46-2576-4f4e-8b62-b77fe0dacd7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870584, "uuid": "f516be98-312d-4888-989b-672ba0441739", "value": "jj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182ccfaf-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621886603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886603, "uuid": "32f88a14-1229-4aea-a63f-2a8c843b214c", "comment": "Malware payload (SnakeKeylogger)", "value": "3cd9ff02e9b29268f96b92cf6a1ce378", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886603, "uuid": "439cdace-8def-4dc1-8523-8b61b4c1391b", "comment": "Malware payload (SnakeKeylogger)", "value": "50898b1c6129cddb36985ddfad41ce8a6484226bdb171e00cb9f21dba8a429d9", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886603, "uuid": "b1996124-f4ea-4ddd-8a92-1e273c70a992", "comment": "Malware payload (SnakeKeylogger)", "value": "047a9150ddef658e0e5d29d38b54a4a47a1dd09a", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886603, "uuid": "51c67090-35fe-451d-bd3a-502e31469cb6", "comment": "Malware payload (SnakeKeylogger)", "value": "635a33a76d02398c2ae3478877333edef082ac034f756fb9e4678874fbc6869153b46b82a1d61ab43ed42bfef7489b9c", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886603, "uuid": "c10af749-3bfd-40e4-95bb-9c6c12fd5429", "value": "30F43396839ABB760176170F1C553A28059CF3503A41E5F8F3C88BB72F5A8CD49D9AEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886603, "uuid": "c9a0307f-ecd1-4584-b35f-692203bc5b4f", "value": "12288:uUO+kyKHQEWY/lktk5oDs2ArUde8m46bdUbl+MwhZWX5P2kTEFYoKK:uUO+kq8/lOxDsb403aFwhZrpIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886603, "uuid": "89d638cb-5dc1-4031-b567-129c3ae570ff", "value": 744083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886603, "uuid": "177cc819-103b-4db6-b6c2-3534a200d9fb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886603, "uuid": "9cead4a9-ad6d-4b4d-9298-a3e797c87717", "value": "3cd9ff02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ea6fff-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875706, "uuid": "80c9f895-1e66-44c9-8181-89022c6fd41b", "comment": "Malware payload (Dridex)", "value": "9d53376397ae75a723a19b0c4df3b35e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875706, "uuid": "f57a4e53-574c-4ab3-8499-28a14792da15", "comment": "Malware payload (Dridex)", "value": "510feb677a682a2d629b886d2a7cc265458f957c7051be813aef47482848950d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875706, "uuid": "96bf18ad-ad0b-4402-969a-921e36b9e3e8", "comment": "Malware payload (Dridex)", "value": "201f782a981a869a9611bbf5b97f5ba0f5a7e5d1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875706, "uuid": "cdc2fd4a-572a-4909-8c02-c381304b0f89", "comment": "Malware payload (Dridex)", "value": "ee1992ee012d4e38dd0663a2e5768f8fdcdc654d96f3fe7aba704547a1260ef904203e98a29a75c482a3e77e8262fb86", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875706, "uuid": "f3c4c6dd-31f4-4246-8752-609fee5fe05f", "value": "E1F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875706, "uuid": "d80001bd-09d1-4568-9022-182f80c82285", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875706, "uuid": "ae96d64f-55c3-4eb3-bc9e-ac59ef971826", "value": "3072:Klpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Klo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875706, "uuid": "f16576df-4075-46d9-a2b9-e8a045f7e89f", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875706, "uuid": "67901698-3bb5-44f6-9b66-16dc850bbec2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875706, "uuid": "3c623128-a01a-46a4-a737-e19d96240fbb", "value": "9d533763_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d96ae8-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818091, "uuid": "dcaac417-f24a-4985-bfc8-71f2b6375737", "comment": "Malware payload (Dridex)", "value": "0e8cf74743656edd3336ef2139f64320", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818091, "uuid": "45ba396f-af4e-486e-994a-f0056cdf89b0", "comment": "Malware payload (Dridex)", "value": "511113dc60368e482125ac5ac2fe170d92d5a245b0e57c999a032461860eb54e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818091, "uuid": "7c819df7-1b56-4e2a-a596-94345ed0b3b5", "comment": "Malware payload (Dridex)", "value": "da4f84831214cc599aecace713040e3f1709e354", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818091, "uuid": "fc106c36-19d1-4333-9b38-4f6b58406653", "comment": "Malware payload (Dridex)", "value": "8578eeb0ba9b024ec84e6c419a246a25040f139ca7db10458628e9a153de50078550bdb0754255ed16f84d914f9dddff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818091, "uuid": "e0e65d0d-649d-4daf-93a7-03c02d6b9f4f", "value": "73F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818091, "uuid": "5e539ea0-8e6a-48d4-b97c-e9b783461345", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818091, "uuid": "64bd0fb9-a7eb-4332-bfd9-958fff7b32b2", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818091, "uuid": "79c9f1d9-f5b3-46ea-ad2a-8584797aab1b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818091, "uuid": "0549666e-35ae-44b5-9dee-fb8818f0a1b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818091, "uuid": "bb493f58-f508-4792-a32d-aeddffca786a", "value": "0e8cf747_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5ceebdf-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875727, "uuid": "545d27db-ec93-4aa2-afff-b3b9a9f396a8", "comment": "Malware payload (Dridex)", "value": "50727431cbe52aa4f6b6a1c8e22dc2c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875727, "uuid": "f5a53d14-c96c-40ba-996f-691eb54981fc", "comment": "Malware payload (Dridex)", "value": "522d9196797f552348b995489822361924fb5e4a505181fbe57adb3c086b2c7c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875727, "uuid": "29c112b4-cc15-4303-a420-5c3ace4c770e", "comment": "Malware payload (Dridex)", "value": "d21a31afbe3ca132ef1f163ebea2e3297253de08", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875727, "uuid": "cbb370a4-89c0-4d51-93a4-a2e251882b7d", "comment": "Malware payload (Dridex)", "value": "543fea41afe6528b3ea67b2f006a45c0523f0d06a813d9b8512eeb2e96816582146eb55862dd491544115663bd08899a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875727, "uuid": "4bf558ae-fd1d-4988-b03a-da8f909e3109", "value": "40F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875727, "uuid": "3062fb48-eedc-447a-b13e-02f96c7da7f9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875727, "uuid": "7c1ec04c-f9dd-4f03-b44a-c2cd55b66972", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875727, "uuid": "e7eee9fa-1c6d-4c73-9540-c2206cc4e0cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875727, "uuid": "c1e16c60-1df7-4760-ae85-98ad442b50f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875727, "uuid": "e007ed7c-1767-4234-9f1a-f2df82f2170e", "value": "50727431_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a12c36-bc9d-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1621867186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867186, "uuid": "acb43f5b-e75d-4195-9cee-06ef46034e82", "comment": "Malware payload (Hancitor)", "value": "5c34fdb7b2210415f922c833499a2dc6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867186, "uuid": "ac620ac8-b8ec-46d0-839f-21711d82b204", "comment": "Malware payload (Hancitor)", "value": "5280dff036e7982537d81d466d35d6db1df816a8bd3eb868adb5fe047d8a25f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867186, "uuid": "ea411d32-fa9b-4d88-bf00-d557f4db413a", "comment": "Malware payload (Hancitor)", "value": "a20ef585d0188a714c4f3077e4d299b72ec8278b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867186, "uuid": "0f2dd5f5-402f-4c57-9c61-fb8d38f2c606", "comment": "Malware payload (Hancitor)", "value": "e5cdae427585c1ff8412531d1cea5aede1770d119faee5aa67bda89910307b552dca317d6f22cb07896d4cf7810e6441", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867186, "uuid": "a07ec295-3c00-4592-bd37-45de05be753b", "value": "C4E48E33B2A28C37C177167D9C2B62E89C2ABE113928BD463FE41D4C5F397817925297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867186, "uuid": "618fb80a-8808-4b11-aa03-5d1a662a0c1f", "value": "976cbee04383163867f763148191e313", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867186, "uuid": "d1f61ea2-ea31-4291-ba3d-2421dc53baed", "value": "12288:uC69N9C/hMHx8kzFfagPtKEp6E72y/N0hwOGt+gRd8x+6vLrD1ag:HKHaY8k5faaboEy6rMzz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867186, "uuid": "970ff514-6734-4238-b92d-321d1e92b694", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867186, "uuid": "45162160-25c6-4239-baad-82dd710efe61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867186, "uuid": "10bc991f-4a01-4fda-b3e7-fb3d80cee874", "value": "jax.k.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158688f5-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814443, "uuid": "2a6a7940-019d-4188-b62f-572543020df2", "comment": "Malware payload (Dridex)", "value": "0e6f6817fb9747ab52e16440ba7b92c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814443, "uuid": "55ccba26-dd91-4e6a-a78c-2a9d8a5b7835", "comment": "Malware payload (Dridex)", "value": "52b747057bd8011c31562872321cbea4623eadc30092c2c85a82cea8f0349486", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814443, "uuid": "221b14bb-8d98-4c60-88ae-6dbc6ee2e286", "comment": "Malware payload (Dridex)", "value": "e08165bebf7a33fba9c22f5b390f92e1e05576cc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814443, "uuid": "3adfe3a7-7d6d-4a78-a223-291a08140a9b", "comment": "Malware payload (Dridex)", "value": "3afcd7f2d5dc6db3a3cb441ae32dee3b504ac3fcdce92b55c04e57d37a08c73289838d4718fdbe25f6523fc3c2661af4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814443, "uuid": "a0d63523-7afe-40fc-9696-c635f0331de7", "value": "87F3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814443, "uuid": "51ddc9a8-63a1-4571-a421-246f24ca49a7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814443, "uuid": "7b43beb7-3896-4819-8a83-d7897587674c", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814443, "uuid": "c4cdafb3-e4af-4471-9e47-01ed12cf6da7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814443, "uuid": "401b259c-4757-4184-8f6f-4d8452672810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814443, "uuid": "d4899468-aa1f-4903-9e7e-cb381ccd57b7", "value": "0e6f6817_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5a4631-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893698, "uuid": "f77e81cf-b33b-48fb-8aaa-6ab20d0de889", "comment": "Malware payload", "value": "f160cd5c37022dbf9ce00a57171dfe90", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893698, "uuid": "0e732842-9054-4416-b835-1631f862e897", "comment": "Malware payload", "value": "52cffbf02a94d05a305126f119d71dc26e789b203db50bdde91e91b7f9251447", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893698, "uuid": "2246a0a9-a211-4b0d-97f5-20672953191b", "comment": "Malware payload", "value": "65af687482c775c3a615b8609d41b11f97760c1b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893698, "uuid": "099c91e3-e2e8-4af6-be98-e976af4cf60b", "comment": "Malware payload", "value": "540bdc28e0642319ffd1b9a80f9e5b83e4b83ef3f89a7409edbff7c03c495d4a3b386260fb9f4a153541f96a3e6fcd3e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893698, "uuid": "e7fa6a10-8fba-4f7b-bee2-91e9f7b66c18", "value": "2FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893698, "uuid": "4f779871-293f-4eab-9fd3-5b621331fd47", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893698, "uuid": "86732896-cbe1-41bf-acf8-a8e65ef96c4d", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893698, "uuid": "2057572c-59c9-4be0-8c24-bfbe0325666d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893698, "uuid": "67269bda-9174-4ec2-97ec-5c2ade0ce9dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893698, "uuid": "63fbe756-0b52-4a4e-a38b-8cc6f9c0fd61", "value": "f160cd5c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461d9dca-bcb3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621876372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876372, "uuid": "851a73e6-5923-4391-80b2-1d4cc9a204a9", "comment": "Malware payload (AgentTesla)", "value": "4393640946ac6d8cb809c30460db9bf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876372, "uuid": "934edaa8-9d19-4dc9-933a-0e648f82a469", "comment": "Malware payload (AgentTesla)", "value": "52d6772c95096ad30b372bcad18e43d565bf1a7a0188c9981bae0213e24e6c4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876372, "uuid": "05115767-a490-4b1c-8951-970e210a8257", "comment": "Malware payload (AgentTesla)", "value": "3ef71e3cfa4e3378ca68b50a370b86b705db5c90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876372, "uuid": "ec13ddc9-dcf3-4ac0-9588-c6a9a08f4404", "comment": "Malware payload (AgentTesla)", "value": "e836742b095552c2b68f605c9a16931d8fae74049203450416a702d281510dd18aab5f6369915bd8c0210f1f7b278084", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876372, "uuid": "c2b8b71e-1fea-4985-a838-8bee87cb57b3", "value": "5FE4E123B6E062D9C6789674ED25EA7063132EA46440F66FB2D4FCDB397D3330466983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876372, "uuid": "20ac3981-7ed6-4da1-a8d0-de1858374335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876372, "uuid": "3ef6dab1-cf61-4929-aa3f-5cf594d0e6e7", "value": "12288:Wg3yiWa4Uo56pgxDwjcz2K9PPU91xvDvUOL+nzg++++4+++++++0+++++++:73yiWa4z5IgxDCi2K9HUNjA8++++4++4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876372, "uuid": "01acf46b-3bcb-4a45-b756-0734cdbe85c5", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876372, "uuid": "23b60de1-c88c-47c4-9b62-55ef098b3fe9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876372, "uuid": "c7c266d3-784d-4a51-88c0-aefc89f71266", "value": "Payment_Confirmation_Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96af3da6-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846872, "uuid": "92afab28-f891-4afd-aed8-006e68f83034", "comment": "Malware payload (Dridex)", "value": "99459a4f6ed3c9a1d6ceaab60d72c3ca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846872, "uuid": "a7f962a7-8a23-4c96-99cc-29a5bfbd4cd4", "comment": "Malware payload (Dridex)", "value": "52eb24ec32774a9bebcbfa1a5df56c7f77a9284f19234de6d9d3ed42d2fd31e4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846872, "uuid": "9702972b-d0d8-4828-b650-46a342a5cd68", "comment": "Malware payload (Dridex)", "value": "05da9780ee97db061b49273ea77e39371f3e997e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846872, "uuid": "decf2ecf-8014-4234-88e2-35bdfa5d1646", "comment": "Malware payload (Dridex)", "value": "ee2fab01aae4bcb28e7e594ead6673404603a2a5a99bb98ba158ed611baf9b5d81e958281af5480ef22c741a82b16b1f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846872, "uuid": "05eb759f-6a56-4bb3-a2c0-92caccfc37e2", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846872, "uuid": "6929773b-fae4-43aa-87d7-be8baa0eefca", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846872, "uuid": "f5233801-9907-4141-9939-f203623fa2fe", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846872, "uuid": "161ed9f3-92f1-46e3-9d1b-7a9a94130f92", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846872, "uuid": "70aae0d9-31fc-4e74-b694-9ea34c69eac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846872, "uuid": "f4636651-c869-440f-ac45-ef15c738f39c", "value": "99459a4f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b9934a-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890115, "uuid": "ab1c3a89-adef-465c-bcc9-e377dfb4194c", "comment": "Malware payload", "value": "063914fd727e9cb619332374ed348117", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890115, "uuid": "2b570778-6ef0-4307-855b-3190f7e04e57", "comment": "Malware payload", "value": "5359f01cc25ecd0c74147279fdbfcb48e2e7575cdb7b4c4fad52e879389cf2a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890115, "uuid": "453a23aa-b52b-4e31-89e7-15f14a34f5a1", "comment": "Malware payload", "value": "1462737d9806fd55ef9e57df152548b09054a415", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890115, "uuid": "14c3c0ef-11d7-4fcf-938b-157bba6701d4", "comment": "Malware payload", "value": "5273feda73b89332fed0135f94df33efccbda4103624962c5b3a77e9c99936bc79d2eaf67b666c4f2b5c31fcc645e6fa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890115, "uuid": "2a4e371e-aae8-4351-9d8c-793ca3cb15c7", "value": "81F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890115, "uuid": "58b6bdee-b81e-4cf2-bf03-9ff1b1ec9716", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890115, "uuid": "250ec357-a5bf-4754-99e0-3dec1cd73a27", "value": "3072:rIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:cc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890115, "uuid": "7b8f454a-1238-4190-8aff-bcb2cb9a7207", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890115, "uuid": "d0372582-7adb-4e11-a123-c2784b0a2a5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890115, "uuid": "b8f67cc6-581c-41ae-bd92-6ecb29786703", "value": "063914fd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2015c6f8-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821762, "uuid": "30127463-ed3a-4138-a6ae-ade40731cd29", "comment": "Malware payload (Dridex)", "value": "360bb3f477adea0c412e485a83809721", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821762, "uuid": "afb33170-7a9d-410d-8e6b-7aff73fc5a93", "comment": "Malware payload (Dridex)", "value": "536e0dbdbb4736383dc5bf4ee387d7126958dde85d3d734e994a0f15f32ae69a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821762, "uuid": "4481635c-18d2-45c0-a9c2-db46fc81839c", "comment": "Malware payload (Dridex)", "value": "7461d88529a8abcf03dcf21843785ee5b4ff73cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821762, "uuid": "090854b1-8dd5-4a16-b88b-f04aea1ec15a", "comment": "Malware payload (Dridex)", "value": "c30a9dc977cbd6255be65b55c0ce1370bee27bd32a92de98bab7a84ea1181e485826f68a8ddb33341dcdccb2a174fe27", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821762, "uuid": "52b1f94b-1c6e-4951-bc34-f7ff9d2c59b1", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821762, "uuid": "f6629354-2930-4105-9143-749382f0e000", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821762, "uuid": "964816bd-4753-481e-8454-3fcca15452a2", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821762, "uuid": "461031e9-03d9-4470-9819-1e596d7a3ed0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821762, "uuid": "9e067feb-b36f-42ae-86e4-522ba89d94ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821762, "uuid": "8df86be4-172f-4d77-a5da-aabf561828ba", "value": "360bb3f4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97977098-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621854175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854175, "uuid": "e6428aff-2c32-49cb-a9f1-62b52fc4ade8", "comment": "Malware payload", "value": "8754081a3f19a192c0924f2384260d9f", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854175, "uuid": "3c93d8d6-0c6c-4cec-9732-5537b0b3542c", "comment": "Malware payload", "value": "5392f59cac6f4b6c7d0379306818a1cad6ff12dc940a5ecb4fac36a2e0dd7877", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854175, "uuid": "2b786159-afa8-4f8c-b7a8-dede4e6c48eb", "comment": "Malware payload", "value": "83ffd5e6b09abfedc61813ccd812ef7916f3262a", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854175, "uuid": "a44747c6-678d-4bf0-a6f8-84645578d0d1", "comment": "Malware payload", "value": "404a96cf01a590df8a8f74331a4c503753ff7d52a05f2f13150a0afa40b27e4abbeee650fa0c5a2ed8d69d8919b972f9", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854175, "uuid": "bc970167-3f17-44a2-a20e-43311eea7579", "value": "D0228D7CC601F92BD121447DF215D2F4E72D0093E622782C519072AE4BA06E7CBEEAA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854175, "uuid": "24d516fe-a3dc-45f1-be41-7359746c2f20", "value": "192:ScIMmtP2w2e3G/b6EVOWe77avWBrd6b95Ak:SPX+w2eSjVOWeiOZksk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854175, "uuid": "f2bd3717-193a-4793-8184-c4e8011553bb", "value": 10347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854175, "uuid": "eb1a346e-5257-4292-b82d-a4127d8588a3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854175, "uuid": "5965d166-9396-4ec2-adf2-27f99dd2b3a7", "value": "docs.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ff7638-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882868, "uuid": "ad85ddd7-9108-499f-928c-166d199c8a36", "comment": "Malware payload (Dridex)", "value": "66baef95fa0d8b1f1b8f2a7282ad9782", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882868, "uuid": "ba99b77d-97dc-45d8-8ba2-b1b91f7b2e53", "comment": "Malware payload (Dridex)", "value": "53c8ba677b1f0339ace0db75df8943ca7c76eb40aaf2e7b3a9586cdeda3e4413", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882868, "uuid": "8ddbd28b-4ba2-4ea3-a0da-13874589f145", "comment": "Malware payload (Dridex)", "value": "75fd5a594687a83b06e008cb12028025f4feb7cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882868, "uuid": "ae05cf05-684d-401b-8b0a-407ae5561a59", "comment": "Malware payload (Dridex)", "value": "dd81ed085d631164210cb7322ba82470e952bd6619dc80ef673e0e9a75a31d00f15ed849e10f8b41076e2b3bc84fa01a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882868, "uuid": "0d5533de-4d24-447a-9d22-e42081de8377", "value": "CBF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882868, "uuid": "cbd70656-50b2-46fc-a5ef-c7cc012890a1", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882868, "uuid": "fd996253-b92a-4152-a70c-cd199d05c480", "value": "3072:NA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:N3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882868, "uuid": "3313947b-4711-4128-b5e2-f133821e39f2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882868, "uuid": "6e8e7cc3-f359-4dca-a1b1-96e016d37601", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882868, "uuid": "dd3686da-7f97-44bc-a193-28bdbec983d0", "value": "66baef95_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df8cc2e-bcd5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621890935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890935, "uuid": "9645adfb-206f-4226-97db-2f4f7fb6f473", "comment": "Malware payload (Formbook)", "value": "246b5e5b766bb5d0804cf9f681b93ecf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890935, "uuid": "0ffa6ee4-4cbf-4ab9-af3f-f1bdbd54e3c6", "comment": "Malware payload (Formbook)", "value": "546a357750ec3b4f5f238d7e1e273f336d11c6ea5ef51976243e1fa1a8e335ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890935, "uuid": "02527a57-884e-42ba-9839-8c32544ab246", "comment": "Malware payload (Formbook)", "value": "7930fb3686841955fe376a506fa2cd7afa595e75", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890935, "uuid": "38f66f99-229b-43e4-98ca-9313ba171fb2", "comment": "Malware payload (Formbook)", "value": "7cbef0dbceb73fae3ed47ad5fe6b44d146fa06688c007d897242dc896d3a351f8d866b5e37a81cd2400b34c5736c09f7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890935, "uuid": "39ba5e1a-d99b-4b63-b98b-9d9e70ce77e8", "value": "3D2412BB2690D1BFE00B92B21866B73FDB7AD6113316214B27704E2B68152D799193F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890935, "uuid": "bfa11aa3-fa70-4710-963d-422347bd2079", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890935, "uuid": "5843b6e2-a443-47b8-b7c0-7cb1a895dea3", "value": "3072:8QIURTXJSMZ646p/zNM5JsW3a7qZz8Eu/bQstgPzi/xZ3xQiDXJnj7mnfSy3fdi7:8sBZIdWEEu9tOay73fdi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890935, "uuid": "48f7e278-c98c-41a6-a987-37ce4f9dee93", "value": 215971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890935, "uuid": "3e8dcb66-9d5b-4fa7-a9e3-0db38807a3ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890935, "uuid": "332f5ece-f9e6-4091-a8fe-62e792b5c7ec", "value": "EJIMS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de15a88-bc35-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621822242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822242, "uuid": "f2efcda6-434a-4175-8d13-01c1c7e0d31b", "comment": "Malware payload (Loki)", "value": "d510730d523ab260f0f40ce79a7be68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822242, "uuid": "af56ae52-8c1e-4f8c-a5eb-d710e76a5a43", "comment": "Malware payload (Loki)", "value": "546acac45052b360db1081aa2dc68f61b38735bd3bb64f5c3500d4e9366fbd99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822242, "uuid": "20ce7e07-f4ad-42af-a464-34c2c9f6c7e1", "comment": "Malware payload (Loki)", "value": "87e0b75dd1209dceeab7774f5b007cf57d5f2e4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822242, "uuid": "891ec3bd-4665-45f1-8321-65aa9b6409e0", "comment": "Malware payload (Loki)", "value": "1dca6b344736aa18126ee08f316ca45d9ba05de5a81fe813734e75832b85c77a8f7027a2d8d423ad9b7d7ca393e86765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822242, "uuid": "4096ff19-973c-4b28-a404-deaccef37396", "value": "FC35D02CA129A032F468C63905D3702BED18D7736021A955AAF7075F2F37EC1BB4A5ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822242, "uuid": "4516a63f-f6d6-42ec-a229-3c8f6749023c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822242, "uuid": "d134d19b-7bd9-4251-91e1-ee81e3269ed2", "value": "24576:hwtZrThd+UIWHgz89CSZegvU+TevdcJG/bqpT:EIfYQpgU+yCJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621822242, "uuid": "5d6ff8be-3ce0-47eb-9cc7-10b886b7cd59", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621822242, "uuid": "6d793dcd-6ccf-4fc5-ac71-d6ec62071943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822242, "uuid": "3036a5f7-7079-4833-a501-22decf150db5", "value": "PO20210517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c8c0ab-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621867379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867379, "uuid": "5cb9f76a-c97d-4b21-b96f-6e7e256211ab", "comment": "Malware payload (AgentTesla)", "value": "11c1a927ae0513ca1b9a8b8fabd9061b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867379, "uuid": "81d5acb9-3a23-40f0-a665-d8fbabeff412", "comment": "Malware payload (AgentTesla)", "value": "54906dba547718d64dedcbb96b4148b49967f584c4930f5759fbb5fabab9d1bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867379, "uuid": "6407a5e7-2108-4a66-860d-c65196a380d5", "comment": "Malware payload (AgentTesla)", "value": "abd9d31256fdc6c38f145131c22db19ebc1ab023", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867379, "uuid": "f2a1e998-dcb3-4195-ba23-d9e41cd14302", "comment": "Malware payload (AgentTesla)", "value": "c47e42d692541494358c465b8aa9db3ea3ae1556ec09a71042791945cb090acbf3bd528d8a3e2a20eb20dd23932a8224", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867379, "uuid": "51ce9fb4-55fa-4e98-8dc3-823ea6c8b2b7", "value": "65A4238C49C02A1B9513151385A671FE7EFCF4D98E6D6088C2142EE97F676AF072ECC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867379, "uuid": "58daea9c-6aa8-4c75-91ee-fe1ee109eab6", "value": "12288:QGpPEoDW/JcZqDkNcCNZS3WZjGR6LUmv/lMDY:jZEo8JcADkNciZwWZCEAmvtME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867379, "uuid": "c338e8dc-92e3-450a-a786-6f62d4756d24", "value": 490609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867379, "uuid": "41040120-3300-4be7-aefd-85fada3df64b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867379, "uuid": "4ca7b454-eb64-45c6-b2d5-65298974ab88", "value": "AMDPI 2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871f4dc8-bc51-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621834391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834391, "uuid": "38520373-a83c-4f3a-b6de-81a2d0dcd6ba", "comment": "Malware payload (SnakeKeylogger)", "value": "c0abf085a4e6bd1a6c7dea1e08c14205", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834391, "uuid": "53dc6e05-4b19-4477-8fb5-628e09308734", "comment": "Malware payload (SnakeKeylogger)", "value": "54c52915b9a166cc18f39c86d2052699397ae13bd68b2e920d99c05edb17e836", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834391, "uuid": "d4f6f843-fe14-4d24-925e-317626e558be", "comment": "Malware payload (SnakeKeylogger)", "value": "c35fbfa3bb22b04736c013cf596ddbf65e555795", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834391, "uuid": "46ac6470-f1b8-4fb3-94d9-47d607fd23dc", "comment": "Malware payload (SnakeKeylogger)", "value": "c3d6ee36f35b0bd853d17de4b075dedeccbb7d53e93c74e44a79b6d007a7e138f6f310178020b6ec3b3a2a22312097ac", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834391, "uuid": "15642e73-fed5-4309-a3c6-1d9db8a63f4b", "value": "EF7423D88B50652C330CAD71FBE99E9388F4ADCB52724CED256E7751163500AFDAB388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834391, "uuid": "2651b802-c9e2-47d1-b9d0-0240f2ec2f27", "value": "6144:LsVzbbwK0pEppJ0cqQgN6ebMQFMJhYWETb1849vVCjMpPdbrHL8KbxxBSj:IcEXEtBbMQfvf1849vAjMpVL8KBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834391, "uuid": "49bd6d43-c23b-42cd-87b1-2645b1bcba43", "value": 366139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834391, "uuid": "43844b48-1473-47f7-ae4c-7618601b83d9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834391, "uuid": "0732cbe2-b62f-4592-98f7-a70fa36eefc7", "value": "PO#975072.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ebeea0-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825336, "uuid": "fe3fc002-0db1-4ca4-9c33-cc059e551ac8", "comment": "Malware payload (Dridex)", "value": "43102acc5eddcc6df3f19c54b2aad348", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825336, "uuid": "00a4c672-1c8b-400e-9830-3deafbbd0817", "comment": "Malware payload (Dridex)", "value": "54cc9599b173a9222d56ab69ef73f04615e113e26bfab9b7d291157e3cc31c9f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825336, "uuid": "108b7d02-78a6-4932-8b90-b7cbdaed3529", "comment": "Malware payload (Dridex)", "value": "d95a15451a1d059f0552cfb5ace9336aa293fd9b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825336, "uuid": "1eaa03c1-7e77-4bf7-bbe3-c6a0da2f281a", "comment": "Malware payload (Dridex)", "value": "e11d9dc476befc1a00efd344f27c6b71f8075d31336e90a3d239beedeb65463ae800b580ff2f490ec9d3ac027d2f8fbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825336, "uuid": "01db8b10-e07f-4ce6-9e83-0c08bc4fa716", "value": "47F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825336, "uuid": "de0c99ca-0623-403f-aa0d-37db73673871", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825336, "uuid": "beaea9df-d3a8-4c35-99d4-408f0badaf1e", "value": "3072:3A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:33J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825336, "uuid": "aea4758a-f372-4c47-a8ae-02b8e43443f0", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825336, "uuid": "428beade-315d-4085-8e75-5e2e7b51ddbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825336, "uuid": "d69d5026-a567-4c54-95cf-a0d59015f9e7", "value": "43102acc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fdaa85a-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825252, "uuid": "698e1b6b-9236-4ae7-b1af-138276aa42ac", "comment": "Malware payload (Dridex)", "value": "a67f52dd396f7ad7d5626517155bfad1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825252, "uuid": "96887874-4368-4200-b8b6-709a019e882d", "comment": "Malware payload (Dridex)", "value": "54fad879f8213afe7579b50af675f7e5dc7e53c278ea7a2928ad17ee13d043e6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825252, "uuid": "b7caf472-31a6-487a-a0c6-8877520e403c", "comment": "Malware payload (Dridex)", "value": "54df6c5435e31cce4c58ca00a441cbff6f9a6a30", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825252, "uuid": "2d2c59d0-ee83-4016-8439-a131e680761c", "comment": "Malware payload (Dridex)", "value": "a2f35fd29de571c7c8d7d57c2684d8ea0fbc7697157010fff70b9b9f5309a513ceb4b8a168b798875420d488da630169", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825252, "uuid": "946add09-3ee4-4e85-afab-6ffc4312be18", "value": "4FF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825252, "uuid": "8a836eaf-8297-4a79-b9b9-8be91488ca2a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825252, "uuid": "036de156-1a30-493a-9acb-04058e8a4a6d", "value": "3072:tmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:MLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825252, "uuid": "0bfe451a-dc28-4280-8646-5015f37a008f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825252, "uuid": "47018add-c276-4683-989f-88e921032185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825252, "uuid": "6273975f-7ec5-4016-bb93-61f6faf73013", "value": "a67f52dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf78e5e-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854048, "uuid": "092d3d0f-a6cf-4877-aebf-5488bfc53b0d", "comment": "Malware payload (Dridex)", "value": "71b1b60a056c3bc9644f5506490498f0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854048, "uuid": "159ef81b-01a4-408d-8c78-cf9e36e60496", "comment": "Malware payload (Dridex)", "value": "54fd77a9bd4f376fc12a382b164587327bf8db5dacbaaeca2c8c06a98c96b0e3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854048, "uuid": "1505a137-2311-4d69-b85e-3a05d6fe994e", "comment": "Malware payload (Dridex)", "value": "6102806030110230780ef4d5797fdab01749f0cb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854048, "uuid": "fd7321c7-ad9c-4c4a-a510-ab7fb4c36230", "comment": "Malware payload (Dridex)", "value": "7ab7a50ae6f774375d72bec803ae56f5a0f7061a83334fed756b337c9738aa18dab8df40a65dc2b0b137f5973de20b68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854048, "uuid": "b523c5aa-f7ec-43fa-a996-8484fe0f53bb", "value": "92F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854048, "uuid": "21b46c39-53a6-4c3c-82da-53c5744ea50a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854048, "uuid": "30b35e01-9c0c-4260-b250-102dcf112b0e", "value": "3072:JiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:6eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854048, "uuid": "2e3d73d2-62c9-49fd-b06c-ca2a88b29cbc", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854048, "uuid": "bedff618-4604-4038-9789-7afd03ab2cc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854048, "uuid": "08525d27-0c25-45d1-b367-80e970ecc491", "value": "71b1b60a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f27d49d-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814432, "uuid": "3fc72488-d060-45a8-af91-3a1839f30202", "comment": "Malware payload (Dridex)", "value": "11cc58532adf81e6442592c773a8aeec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814432, "uuid": "da952e3e-2449-4d60-bb64-8a11b37994e5", "comment": "Malware payload (Dridex)", "value": "5565edcf853b4038e181924f6e5c5754a1c97ee0f235b86adc09b4bb59c51fdc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814432, "uuid": "b56e255f-a807-44d6-94b8-e78866e80008", "comment": "Malware payload (Dridex)", "value": "b0e7831d636f756d9991aeb26ac638278a12460f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814432, "uuid": "00344619-638b-4f33-baff-0575ee2343a1", "comment": "Malware payload (Dridex)", "value": "72f247fafa76e65df0fc4297c08d314d691697ecb7e6107d3ef8823f230db1ec56cf5781dfe618b88493631bafef62b2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814432, "uuid": "46b3771e-c11c-4388-be8b-ab53e11ef5f9", "value": "6DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814432, "uuid": "f9175079-e52f-4cb2-ac39-a7495411f062", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814432, "uuid": "6597ab5d-fe9f-4eb4-baad-e649851709d0", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814432, "uuid": "87b5331b-926a-4ff6-b0dd-f935c21f3c2c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814432, "uuid": "6ecd06bc-ee4f-4522-b3bf-ef8247ab7f38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814432, "uuid": "86fabc31-4af3-4392-ba2d-444b31054dbf", "value": "11cc5853_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0470a4f-bcae-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621874430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874430, "uuid": "7f11808f-3d1c-482e-96f2-6155bff375a0", "comment": "Malware payload (Gozi)", "value": "2144735e6e211a17d20201a05943cb53", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874430, "uuid": "78b434de-7671-40f4-b7ac-88088908d6dc", "comment": "Malware payload (Gozi)", "value": "560b6b4c07c31f08cb8f5ebfa7eaff01e28209ce6e13da9bdff4b1fc2a4df505", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874430, "uuid": "f688c1e1-4d1b-4d92-9c1e-93a8f0e6fabe", "comment": "Malware payload (Gozi)", "value": "f0d189d9a28769167ebdeacc2143c990a75ee15e", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874430, "uuid": "1fe83c64-4ecc-4d9c-a53b-049929f7a891", "comment": "Malware payload (Gozi)", "value": "e3c058332ef278c52cb778daf93e151761d35b3b2338dc8262cfbfdd52fb9d7c52043a3ba54d14992595158871adaf9a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874430, "uuid": "ab1de598-6c30-481d-a581-b3ea6a387e54", "value": "9C946823BBCEC142FBB75E3FB5A6882255F6ED436433953A10C57904FAB697428D2270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874430, "uuid": "748d8bd9-23e0-4521-8941-fb0782adb0fd", "value": "04af3d5ba3bfc9df5ba8fe61b6d1b178", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874430, "uuid": "f2cb750c-d3b5-44ec-be87-94cc3160e5f8", "value": "1536:Km1IvtdVQY0xfmCXalgtnLKd/+M8GJulgW3OMnGNdRytgSXjWM15FiDaYTvJ:Km1IvtdVQNxugwws+MrA7FnG7B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621874430, "uuid": "ae636a8a-adea-4112-ada6-9ee2559e707c", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621874430, "uuid": "96efdf64-1e33-41f8-b41e-014f6af47442", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874430, "uuid": "d48fb1c0-d65a-4f4f-972e-c27190999c5e", "value": "sait.pko.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e250fe-bc74-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1621849579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849579, "uuid": "e6159c2f-ee3c-463f-8f89-98e5ef734af2", "comment": "Malware payload (AZORult)", "value": "40c43559141b32cbd17b6a516e19b99d", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849579, "uuid": "3d3690c3-47e7-4bcc-8b8a-1f9067320ad4", "comment": "Malware payload (AZORult)", "value": "564442db263b94b2c883eb88bee9b6462abbe7b377fc0dc820aeed3e9c97e971", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849579, "uuid": "6f167a1f-6df2-43ca-971c-b30097bdf056", "comment": "Malware payload (AZORult)", "value": "121153e8a54ca9dfd0e257273e402172c3059d75", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849579, "uuid": "55a7ff32-4b8e-4774-b3f8-7a4cacd30b78", "comment": "Malware payload (AZORult)", "value": "538e8ef0404b8066d3d5160fa4c4f81c9a183cd04e4d108d7faa34e6e8ce470f44ffb22a2463e76298ede10b13c90e50", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849579, "uuid": "16861cb2-01ec-4f71-a08e-a2268e89abde", "value": "E175FCE234DBB51687E78F888124B7FC81F202757E04D8DB3E71369385A874767A628D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849579, "uuid": "3a95afa9-e98f-4cda-93e5-dedad8cf6861", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849579, "uuid": "a0343446-d366-4a64-a1a5-4358efc078c6", "value": "24576:y7e5lL+Ml+y+a+y+a+y+a+Z+2+2+2+2+2+mkDmaIiVN+XF+D+BJ+a5eC+clVSdvE:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621849579, "uuid": "4502614a-6f3a-4637-a24b-bcee1c74c8db", "value": 1687552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621849579, "uuid": "6e69ad46-f1ce-41d4-ab78-390d09837d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849579, "uuid": "178fc3c5-ade2-438b-9219-7aeecb520cec", "value": "DOCS....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea677aad-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872353, "uuid": "af0a2bca-a474-49ed-9718-996964838cbc", "comment": "Malware payload (AgentTesla)", "value": "acf9f1a62cc03d94070a7767a5d9031e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872353, "uuid": "7af5f873-e5a8-4e6f-bff3-3571851698fa", "comment": "Malware payload (AgentTesla)", "value": "56448f2b0d341830f134ee2911a8a5db212b61eb95b747099a644d268a928bda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872353, "uuid": "123b1965-c61a-48b4-9f0c-8dd8f74b779e", "comment": "Malware payload (AgentTesla)", "value": "e95f5c0794088dd912069915be3ca133cdebcea2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872353, "uuid": "db7f1bcf-482d-4379-b7c3-b93f2270b930", "comment": "Malware payload (AgentTesla)", "value": "d2ba324332a4224d2cb13c611f0ed84e41acb6555c1f136a0262b7903ce6aba22b047f8b41528b76c688460777db4ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872353, "uuid": "3094246c-a8c9-4278-8894-63cc92a84571", "value": "CE3516DC5D5AB11AC159D27831C040BFD393EF3320B9BAA69AC7EBD94717E4074812AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872353, "uuid": "45b2f64b-48dc-4aea-a0c3-70add966d45b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872353, "uuid": "c1f87b88-f177-4ecd-89a2-220c358f990d", "value": "24576:iBCIvaiD3QMVg9EE60F58g57l/OZJJCCfLc:iBCIva63QMVg9n60P03Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872353, "uuid": "35fcdd59-38e0-4c14-bdcb-0c1bac1de388", "value": 1073664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872353, "uuid": "154d8df7-8af7-49f0-ac97-5b9040209e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872353, "uuid": "ef3b04c6-0b22-45d1-9282-13ee510feddd", "value": "DHL RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30906861-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886644, "uuid": "4d2d9560-0161-4588-bb29-e155961067ca", "comment": "Malware payload (Dridex)", "value": "f91102417300c57c6c424575e6b5f1c5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886644, "uuid": "eea34d8a-f664-4202-ad64-ce116f4fd225", "comment": "Malware payload (Dridex)", "value": "570c774a4f026cf1f04e148ace448e17687e0ef273c56792562046a2481b2454", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886644, "uuid": "d0537629-e5de-49d3-805c-4efddf9300c6", "comment": "Malware payload (Dridex)", "value": "7f296fa89ee12c1d949835f55767e27fe7480478", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886644, "uuid": "186ea799-97f3-4f24-9d60-e3923d1998b9", "comment": "Malware payload (Dridex)", "value": "08bc758d7545e62b960ea732c6513404e9392b96b2fa860d07e4daa9cdca841d7d586d490ab24c0e7a8f748d4696dc4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886644, "uuid": "e62e49f5-174e-45c4-b8e4-aea9ab6d18fc", "value": "1DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886644, "uuid": "a8d38814-b304-409f-ba76-6d1361364b79", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886644, "uuid": "f2c789b8-b8cc-4ef9-9aa4-f8832cce5a62", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886644, "uuid": "4f3f5d06-90d1-48ce-9ba5-c6834525ab08", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886644, "uuid": "c7893d95-db4c-49dc-a426-a7b8a4140f4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886644, "uuid": "7d8abed3-2ced-4533-bf2f-74ffebbf4255", "value": "f9110241_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4123cb19-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814516, "uuid": "4e7c638c-8ad1-4eb3-a337-8aa6e8e5c158", "comment": "Malware payload (Dridex)", "value": "45c05c32e8fe37e9cfd2d7c3d695e9b1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814516, "uuid": "b63c4bca-b35c-4e1a-b476-e0d1b9445a13", "comment": "Malware payload (Dridex)", "value": "572851e9a6b133b2af970c90e2e62a0a2eeecae8d3a1634cf5013106900e4613", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814516, "uuid": "f28553b8-4699-4755-868a-40fd65bb33f2", "comment": "Malware payload (Dridex)", "value": "981afa392a496727499dd81c9151a33c6b529b35", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814516, "uuid": "2b7638bc-f02f-4d33-8e61-6910c57d5a2b", "comment": "Malware payload (Dridex)", "value": "3bd37d8cb3f5bebda88ae82c1f880830c411a024aa2fe90abbd83a4782c35b592ac5fa66499624a21bb260ca4eb7f724", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814516, "uuid": "21c18da1-6f61-49e3-beee-efc63648d43f", "value": "C7F3D0D3E21FD1A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814516, "uuid": "c05d8403-7563-49aa-8c28-c27a99eb834a", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814516, "uuid": "16116b5f-5c94-45e2-9798-67dea319e478", "value": "3072:j9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:j9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814516, "uuid": "0285b7e6-868f-4575-b5ab-2151fa2146ff", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814516, "uuid": "35a8eb3a-67a5-4a1e-bc87-5bf344fe74ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814516, "uuid": "f47f34fb-a3aa-4330-ac8e-5fb1d68193ae", "value": "45c05c32_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a257d6-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821713, "uuid": "d85718aa-8379-444a-a143-75345e22d91f", "comment": "Malware payload (Dridex)", "value": "698f6a62da8da0bb4a917b0aa49cc867", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821713, "uuid": "79fe2092-52f4-46c5-a1ff-b5af62bed69f", "comment": "Malware payload (Dridex)", "value": "57ac7584ada9e89cc18f8aacb101f874ed0f972e37028166426885155b451317", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821713, "uuid": "ffb46776-a03f-4eb0-9a5e-d86d5a9c11f3", "comment": "Malware payload (Dridex)", "value": "14f5c6a798fef293f6b59ed132172c192e9132d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821713, "uuid": "35a0453f-0861-4090-9ed3-b3b9498f63d5", "comment": "Malware payload (Dridex)", "value": "eaf5374b7c200aba128c5d3dc02331cccddb373f552ccaea3b27f9cccc2d1aaf4d8d8e12694affc955494f5336827f73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821713, "uuid": "322e4e48-3731-4628-9b37-fe7f0a2f79a9", "value": "E0F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821713, "uuid": "6ce2f2ab-6fe6-4396-83b7-085f57f182ee", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821713, "uuid": "3d85f035-ab4b-490b-8520-391523996511", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821713, "uuid": "3bd99591-398c-47a7-9120-adce92ca4173", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821713, "uuid": "0d124f3b-396d-4d30-bd8a-882203731103", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821713, "uuid": "aa0ce7dc-be13-4f5f-9cf7-1ee8669c408e", "value": "698f6a62_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e29cd9e-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814538, "uuid": "fb00345e-f7b3-48b3-9f9a-103f98bab5d9", "comment": "Malware payload (Dridex)", "value": "922bce3c0768440cfb7fd8542902ef23", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814538, "uuid": "5ab26944-fe99-4547-9caf-a3410b27f16a", "comment": "Malware payload (Dridex)", "value": "58080f430c02293b24944374b37f9c1f32bf1562d264390ec8d7beb2e1103c5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814538, "uuid": "10804849-2fce-43cc-a3e4-090dfb7b7ac6", "comment": "Malware payload (Dridex)", "value": "8267cf3f9d2de327be8600f37fce3b2f08b8a472", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814538, "uuid": "5230d9f1-e1b8-4523-91f9-44057636916c", "comment": "Malware payload (Dridex)", "value": "7f5f755de73c32d1775c887bc4a7184a44e12e3447c0868c007f49675c28f3ead2750e5389d64dcc3317396c7c10db66", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814538, "uuid": "9afe8227-93c5-4f9d-8377-309e13681065", "value": "D3F3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814538, "uuid": "c206e00b-4448-4c76-b38e-dc66098bc50b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814538, "uuid": "c409655d-5adf-4307-891f-356909a1f1f1", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814538, "uuid": "083a823b-1e1d-4614-94fb-e10e51ea0752", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814538, "uuid": "9f13e041-e51d-4fe1-92e9-09833267a0f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814538, "uuid": "ed158944-c60a-4b4a-9c45-b742b21cd68e", "value": "922bce3c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6658d22a-bcb7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621878144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878144, "uuid": "2c5be05e-0d43-4938-9f42-b9a539cd7c6c", "comment": "Malware payload", "value": "360ef1fe164a1baeb3488ae087fe6959", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878144, "uuid": "59e16667-7df8-45ea-8dc7-a8e3b3990c65", "comment": "Malware payload", "value": "583b718c8ab6549a83b0d94077f5409fc27037ec320c31ad0134f67e7bb16823", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878144, "uuid": "99bee7ab-321c-4494-986f-61a37b1ec7b0", "comment": "Malware payload", "value": "ec77f3c4f314b63f8ae0759264725e7a8c257b45", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878144, "uuid": "8ead5075-ee95-48de-9ed6-a843d892c1d3", "comment": "Malware payload", "value": "24a085b34d5684840625e98d263e4ab82073cc9be4f07149c4181b62ac5d58122941c6736db172337b1026022fbc04a9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878144, "uuid": "3a6d9bd1-931b-4065-a583-42d60be9da6f", "value": "BF94E1D0BAD18132E1780C3F4835968927276B79C71BEC7F6340AD3C5A361E64B939A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878144, "uuid": "fdffd852-668b-41f8-a64a-17d93d9b732f", "value": "12288:BiiEthsYMlPYnW+Marq7ChKb7qqJeiAlDfC18+piE:BTwhhTzKkK8Z3+pV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878144, "uuid": "feb96358-dd67-4b90-bb4d-5f61ba980448", "value": 440645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878144, "uuid": "9f199073-9fd9-4f6b-95bc-b1f30fa36a4d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878144, "uuid": "4df91b26-cc1e-4e54-9283-a6fbcf1e14b8", "value": "upload_1558856009.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fbdb37-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621886472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886472, "uuid": "1a60c6f0-025a-46ec-aa8e-7e593fbd2330", "comment": "Malware payload (Quakbot)", "value": "752183ce99f0566e999992f26395c6c4", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886472, "uuid": "2372eaf2-87fb-4cfd-9689-e3bbe86a9f22", "comment": "Malware payload (Quakbot)", "value": "586c624c79cec8f00124a956a0f15b59452dc59149a8df61378c1234d8cf714b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886472, "uuid": "2802bc31-03e7-4603-836d-74be95fc93db", "comment": "Malware payload (Quakbot)", "value": "fb00269626b4624b5d81d1e7e42a2d50e39d9993", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886472, "uuid": "7b48bca3-cf15-4f0b-8f80-c7d47fe39478", "comment": "Malware payload (Quakbot)", "value": "1bc8c2ea3aa2cab6f7e0caf9d682c82f47481cc38729b7ef8feaa844c9d18f7036d519255c545ddd8da88e4b98865bbf", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886472, "uuid": "e6f36aa5-8156-4236-a6fc-fc85d7c47018", "value": "4D758C366359CD02F72A0B7561D38A247871EF9F3221871BC5E1FA18F839BB56C8D264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886472, "uuid": "5ed14437-4533-41d8-9e74-33d4a68db808", "value": "478743f1d3d70c2a8c9bb38305173291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886472, "uuid": "ebb40db4-ed49-4b0f-98fa-3ad6ec5365e1", "value": "49152:is3kMuO7Tb8fii23vtlJhOmaywo8Ubz3vtlJhOmaywoUUbz3vtlJhOmaywo8U7TG:itoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886472, "uuid": "aa38ec3d-1c3e-4a60-b5f7-6c5cdc96e4cd", "value": 1657344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886472, "uuid": "e896d11a-07d6-4182-961a-80e8891fea25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886472, "uuid": "b16f29e1-6fae-4896-88cf-b6047ef586ae", "value": "752183ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6207ba25-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621882861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882861, "uuid": "78fbf07f-4b77-4613-840d-a2c0e8859945", "comment": "Malware payload", "value": "0224e1ff0daba2fb434aafa681f3b69a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882861, "uuid": "74ddac35-14f5-4b48-affe-09485e38d7a8", "comment": "Malware payload", "value": "587a791fad646b2ae1e2c63e4aab5297c6148e91d753d68ff8e5c585088a7627", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882861, "uuid": "24460bd7-6e7c-45f6-9035-055299678737", "comment": "Malware payload", "value": "e910ea6850b3a4c69b2c8dc0e320a245afc520ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882861, "uuid": "d78361ee-10c7-459e-8037-b53be4772034", "comment": "Malware payload", "value": "e12044cacf9c8b38f72701b5abcc414d356188f7e0af4d2a34e7f66f11401b18fbd624d1d0212d5cfe0fbcbd898adfaf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882861, "uuid": "a2eb2384-a452-468a-8956-fd8b50568770", "value": "F40412B378F3A8B99F532E25948187A205EB5B834E171D7EF30B94E4F3A9957C10058E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882861, "uuid": "414d191d-3ecf-4e1c-9e12-aba03177c4c3", "value": "3072:hwRlNj25kmI1jdv8c0S+MHIxBasCFinA9xeXB49TOO10OHRHMwn:Ol2km6v8c0S+MoxBXC0ArU49D19tZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882861, "uuid": "d6afbd06-c234-4a00-99a6-110190359236", "value": 176996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882861, "uuid": "51946a8a-fbff-4928-b29f-f70191a03085", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882861, "uuid": "b9852a6a-52d7-49f9-80bc-a5d85b432bf7", "value": "0224e1ff_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227aa0dd-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (IcedID)", "timestamp": 1621886620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886620, "uuid": "2111bba5-96e6-4e4d-aa5c-8b2ac4b53a4f", "comment": "Malware payload (IcedID)", "value": "eb29352af8c0376ee6f9b8f87eed11c7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886620, "uuid": "d49c0e3e-d4cd-42e2-a331-3c09c0cf4fea", "comment": "Malware payload (IcedID)", "value": "590eac4ef1f146780c39696f31c3e14300c4a9145743d282afe48c4e93cbd0c4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886620, "uuid": "41bb6152-7ab2-4ba8-bb45-3b5cdc2c71a7", "comment": "Malware payload (IcedID)", "value": "ed6081590e6c26991db74810b743e85057af1caf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886620, "uuid": "d54eeb26-41d8-4895-ad1b-2f07f6b437d0", "comment": "Malware payload (IcedID)", "value": "36a63d92dc48967ba72d5204e0671b874d91f37d1fb4c258376db83288d0fbc51ff5021d97ee2d24b66698fefe6bd96e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886620, "uuid": "0eedcaf7-01f3-448d-860f-c7d02415ae7f", "value": "2304123CD4224D5CC2B9447AD918C2496C292113BDF8A5BE25C87988EE577F31F6FB84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886620, "uuid": "9e917cd4-8119-4978-950e-33a9ecf8346d", "value": "3072:t1W/eXE59b4DETZU4yvUCidynhV912A7bF8mrcLwKw55eiETTcDGJb:tnE5SDvbXAyHbVt15wTQDeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886620, "uuid": "b6d6afaf-4238-41cb-a1f0-b000b7c90018", "value": 178463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886620, "uuid": "a4651f01-da21-4a41-88e5-be061372caad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886620, "uuid": "3c029df0-a211-4985-aee4-93cdf13618c2", "value": "eb29352a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a269fdc-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839845, "uuid": "17501473-c9f2-45d4-a12d-a85b056a8e65", "comment": "Malware payload (Dridex)", "value": "7cf9a7697510e3f054a87b41bedea7b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839845, "uuid": "43da7e4d-103f-4d66-b955-482eef9cde2a", "comment": "Malware payload (Dridex)", "value": "599f0973090efb34c3494800e2ab63d27b3c7be8eed9c6337f6c114319de13d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839845, "uuid": "e9ec14ba-cea6-466c-8b3a-75882068ad29", "comment": "Malware payload (Dridex)", "value": "1b462125b1857fe0cd09f6a25c4b9eb3ee2976dd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839845, "uuid": "9a412e2d-c43c-4154-9794-fdbaaacac55c", "comment": "Malware payload (Dridex)", "value": "ab0dee70028e35370b970cd16a26ce32e2c3a7f4f4c0b8450d25f376e5196019454d3f43035ffe52b23dc4432caf0da8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839845, "uuid": "54f9b17f-22c1-4a23-af66-c788437f2397", "value": "9AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839845, "uuid": "7bb5d04b-3cb9-49b7-ba7b-0cf4b3a0d929", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839845, "uuid": "bcd4daf5-b028-4c91-8315-8a88c38fd557", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839845, "uuid": "ac68789e-59bf-4c96-950a-a042e3e95bc0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839845, "uuid": "b10e48aa-6335-4f91-8f49-d6b9cde0c7c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839845, "uuid": "711abb50-5fd4-4573-ab5c-cc7f06331124", "value": "7cf9a769_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1aa619-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871153, "uuid": "ff8db988-4e2a-42f4-9ab9-334fa2cb09b0", "comment": "Malware payload (AgentTesla)", "value": "9b54f32a9b170e3e87392304612b2456", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871153, "uuid": "ebaf91b6-4008-436a-a806-347d8972b9c7", "comment": "Malware payload (AgentTesla)", "value": "59e95773823f80a5f5eff8dab98f3e80da1ddc9e7643a82933527adebaaf13f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871153, "uuid": "7cc1170b-38ae-4ac8-86d2-40d0372fd7f9", "comment": "Malware payload (AgentTesla)", "value": "44dce41d9e2a557eaeae172e9c2a72e755be2860", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871153, "uuid": "a48e4f3d-2fa7-4f3a-800a-8ab956cb2ded", "comment": "Malware payload (AgentTesla)", "value": "fad866930576ce2f53a2c5c80425f954c27f7a3bfef445958d7e99f7291c4d83891c362f419b314061e23f02e682a15d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871153, "uuid": "9b8de1ae-1660-4b88-8b9d-de0f79004752", "value": "1D258C2C116AF122C2A8C27946D5953BE5A0DF377531BE19ECD733985B39E40BC8227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871153, "uuid": "477ceacb-9b9e-40b7-a6b5-f6fa94b67830", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871153, "uuid": "d1022be1-2354-4e68-9d14-ac8722e5f7cb", "value": "24576:9BCa81GcejBrYl00djvbBh9gBRnhDitvLe:9BCaW00DMBWtvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871153, "uuid": "d78da444-7148-4cb6-b659-0157e548102e", "value": 1031680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871153, "uuid": "d3008548-9a46-432b-88b3-b3e029f6da7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871153, "uuid": "2db4c92b-1b65-49fc-9d24-695babcba752", "value": "PACKING LIST CORP INVOICE 2738829 DATED 26 FOR SHIPMENT AS STATED ON 26 APRIL05I992lcNll.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d090c3-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621879170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879170, "uuid": "d87f2ffd-c444-4c03-98ae-a52a3e57172f", "comment": "Malware payload (AgentTesla)", "value": "76c61f35c06b4d510bc59d3f8aa42fea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879170, "uuid": "d8f8f366-9f2e-4227-84e1-30de54dac2fc", "comment": "Malware payload (AgentTesla)", "value": "5a4fe10326ac72500a31d18a631a66100f2a7d95026eb4c39493774d3df8079c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879170, "uuid": "0c17f886-2aee-4d9a-8864-ba21b7953b83", "comment": "Malware payload (AgentTesla)", "value": "7469de7c70ad16886f83264117af77a78d17ea66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879170, "uuid": "0a4c0dea-9322-4db9-b3ee-6271761a4fdb", "comment": "Malware payload (AgentTesla)", "value": "b0d74ced0c41c814901da2a5699e24b35e8995f355e4f1724cd2af76cd514721fffcc6d83a0f69f795784e2d7f97bb56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879170, "uuid": "20bc2670-96c7-41f0-9989-3fe82f86dddb", "value": "8B35E11CA169A132F468C23905C37027ED58C7736121AD54AAF7175F2F37AC0BB8E5AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879170, "uuid": "55515699-ef05-485b-afdf-c5b19f125dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879170, "uuid": "0fac4d8f-049c-41ed-9575-b00b3e3aafa7", "value": "24576:TUt2iiTXf+awlMXa+OdoJwvjjICxcfG2:zXm1lMXa+dwvjjT6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879170, "uuid": "97d4a3b3-0508-4d53-8b9a-0d524a82d0b8", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879170, "uuid": "437139b7-8286-445b-8c4f-532105e8d589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879170, "uuid": "85a66119-8bb8-4397-a490-67d1b3f1fa00", "value": "76c61f35c06b4d510bc59d3f8aa42fea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4d3fda-bcad-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621874072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874072, "uuid": "6851d41b-df34-43eb-b268-d846834991a3", "comment": "Malware payload", "value": "ff5a0025edee17d2f5f29966af06743e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874072, "uuid": "80eac49f-68e2-4dc0-9895-217eae54956c", "comment": "Malware payload", "value": "5a8282254fc150756f8fef3d823852b055be1e561d6bbcc9b55e71d1f5bb6b81", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874072, "uuid": "d33c4572-129e-4b67-9432-06074599a74e", "comment": "Malware payload", "value": "dfae4d2798c805c41b6515958d1935956d2fec6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874072, "uuid": "b0bc751e-779a-479f-a819-64014437ccd0", "comment": "Malware payload", "value": "cb5ec1f6fd82c0ce42d76d693d1b38be4638bc619e2c8926cb161b15be630925629e977ea32414f82dbe8cd4a19a6780", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874072, "uuid": "ebe2602a-36fd-4dc7-9d0e-465da798110b", "value": "2486F87C62DC3D97F1EA5D30B5663EA0027B7E475AD62E80715AF4B002FD352AE9480E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874072, "uuid": "fe25930b-3b7a-4778-95a4-2a1471553e58", "value": "24576:TbH/vwhrpjZTEHgalQRYUOObxRgfJuUAUAUAUeSCJorcqQHtGkuzTQ28Gawc:Tb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621874072, "uuid": "225c0582-9e12-40c7-9ceb-d21e48d521b5", "value": 8389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621874072, "uuid": "71b4e447-8c56-4147-b895-dea827008824", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874072, "uuid": "ed632b97-d8e4-47b0-b8ad-462b1483318c", "value": "5a8282254fc150756f8fef3d823852b055be1e561d6bbcc9b55e71d1f5bb6b81.vhd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2e9365-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1621837780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837780, "uuid": "ba1b2f32-c30e-47f0-bc6d-4999e9564bed", "comment": "Malware payload (DanaBot)", "value": "cb65d0ecac00425487644a2cbe4dd400", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837780, "uuid": "485adf66-7e23-49c2-9ddc-00fb9450e014", "comment": "Malware payload (DanaBot)", "value": "5ac9bb875dd59b311022ef7f641019e2f1e4e4dd70033b0229a4d7790d419019", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837780, "uuid": "248aded1-7836-4fe4-a3d1-5af97aacb15a", "comment": "Malware payload (DanaBot)", "value": "9f0f5f71367728882c8c42d9977150c581d8a741", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837780, "uuid": "4fbcdb75-06d6-4417-ae77-6faf921a46fe", "comment": "Malware payload (DanaBot)", "value": "e3adaeca1d38d527ac4fe339496196f7325ea1059d4f05c0c41e81ac995f7cb0b88af3f6de957b6a9b27072b6f76e1db", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837780, "uuid": "5d27624e-5fe0-4023-92b4-ade2a8047949", "value": "33563320AAE3C430ECEF14B909B19174683A7DD14772A0FBA1D937E919B05E89E7171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837780, "uuid": "962b81cb-a3ee-4483-8412-1801cce8e003", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837780, "uuid": "a256c97d-a5ea-4483-8fc2-940792e8a574", "value": "98304:2hplROMqiNvnEsce1uHeCcqagAaZASj/kA6nAdD9yrxM4738PkYknF0RtX:qQPsce1ilYcp8A6nc9gxM47M3kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837780, "uuid": "6b3e52b5-f1c8-41b8-a7ce-0bd53e7a0358", "value": 6327296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837780, "uuid": "a49f489a-a35e-492e-ae8f-020bdc55f421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837780, "uuid": "0cdb27de-1ec0-4d3d-9aaf-8c1f8a81c03e", "value": "cb65d0ecac00425487644a2cbe4dd400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7816cf4f-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621818044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818044, "uuid": "073c410e-cd28-4086-a2d9-74ac7cbf7cba", "comment": "Malware payload (Loki)", "value": "13df0ccef592b06d04431ffe89686db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818044, "uuid": "9c37e373-42fd-46d6-929f-7145722ff76a", "comment": "Malware payload (Loki)", "value": "5c010faf4a40636a3976ec2997b6627f105928362988edf09c94a54c4c074e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818044, "uuid": "b286cebc-b6cc-4ed9-8d12-5d86a132242a", "comment": "Malware payload (Loki)", "value": "dda99104793032416ff5b1e9a5dd04ac66c369c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818044, "uuid": "9a6e1a13-e800-421b-a082-15dbf813979d", "comment": "Malware payload (Loki)", "value": "4db8e660b0a24dc00eb2f899883fae8237b531dbb51066aa242020836ee960d005f4ab4ccdceaa0f6f3010daf6c9291c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818044, "uuid": "0122bbb7-868f-4561-a8fe-e22782a22dce", "value": "E0E3025A21E945BBE5630A720473C31AD77FFB025711079B2B590FAE7E210C6AD623E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818044, "uuid": "fb7568bd-b4d0-472e-bd58-d4354e7899a2", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818044, "uuid": "4f80a8ce-b0d9-4f27-98cd-7d83487f1d70", "value": "3072:DQIURTXJ+MScAcfeMebWsXZ+xhml1TjNAyobBjBL6Bqh10kAt:Ds91AcfHeqQ+xhO1TjLobBjN6EE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818044, "uuid": "4270bf8c-bb81-47fd-b0e4-662573a74207", "value": 154532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818044, "uuid": "1744b476-6fca-4565-bc96-1550c207bda8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818044, "uuid": "b6eb63c7-cb3c-48be-a7ed-764348e481a1", "value": "scan344567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbeb7435-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846935, "uuid": "842eaccb-8a1c-4c86-9414-6acbd4aa5359", "comment": "Malware payload (Dridex)", "value": "cfdfb67f34850378c4dcd9e66cc1bdee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846935, "uuid": "ef2aff60-6625-4a06-82cb-61a3e131e16f", "comment": "Malware payload (Dridex)", "value": "5c1453345caac6d571baa471aaac7a5ae77520cd11156380e60f9d952af2f7b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846935, "uuid": "96fb7e7b-e938-40aa-a428-8b6b4d30ab45", "comment": "Malware payload (Dridex)", "value": "cc6d1a0c3fe06a8712793a91e75e4b50fb8609d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846935, "uuid": "f41ecf62-f733-4e8d-bec1-6b22ab0d4422", "comment": "Malware payload (Dridex)", "value": "0f2b3edf205ebc60cf802eda45e84967f40f9dd340fa89bc377ee9b4a217a78b881f3dd0555b65353bfaef6ef91b29de", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846935, "uuid": "a6748a98-c452-4a20-9c10-59488a7116b7", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846935, "uuid": "f4cd0071-3c6a-4cf9-a373-c5633c14c210", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846935, "uuid": "53f593e3-b359-4f87-8726-d5a3909cdbb2", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846935, "uuid": "9d12b1dc-5bf0-43de-9a0a-ad9c423f960e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846935, "uuid": "6b00e885-e90c-42cc-ba0f-6b939e887268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846935, "uuid": "ba449d17-64f9-4182-a634-f256655709dd", "value": "cfdfb67f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17af6660-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861262, "uuid": "72a2639e-7c48-48cf-98ab-2e5f7b8cdacf", "comment": "Malware payload (Dridex)", "value": "d79b61ce9226f5f36c8fba5617f4c9ad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861262, "uuid": "11095e67-7ed0-4c42-bcd5-97b3a2e031ed", "comment": "Malware payload (Dridex)", "value": "5c585381481c96fe02ec0a962984ee4e02dbdb8d81e22cf17b02f43983e118f3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861262, "uuid": "136c888b-3679-478b-95ad-b712974fc16a", "comment": "Malware payload (Dridex)", "value": "1abd1b3ab8d9e4b90e7eb405475758ffebc7e33d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861262, "uuid": "3b334090-c26c-4e40-8860-6bb045a42062", "comment": "Malware payload (Dridex)", "value": "43a95b709aa0d88ba1728a2662eda4eaa023d208bfc49b578c1a528c0cf2b836601e720ff9abb33db07e6158c652b842", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861262, "uuid": "b9a2632d-17db-4d9b-8316-f908bc96f7f5", "value": "70F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861262, "uuid": "cdac5975-e9d8-493f-a5a2-ad435a33fdef", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861262, "uuid": "1ccb0e9d-3673-4e92-afcb-c2e61e183c51", "value": "3072:/IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861262, "uuid": "3b7250ec-201c-4d85-ab3f-d50919f5e0c8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861262, "uuid": "3da98f77-f3fc-4fba-9a6c-d1a504d48233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861262, "uuid": "cc92c3a0-7ec1-456f-98f7-e56be35cd02b", "value": "d79b61ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a71c94c-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621879440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879440, "uuid": "a6088304-da58-484a-81aa-6a6bef77a832", "comment": "Malware payload (SnakeKeylogger)", "value": "e378047dde3a95de8ce0a2dbd0797ddd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879440, "uuid": "a6d7788f-ced1-480b-b76f-cc130837e127", "comment": "Malware payload (SnakeKeylogger)", "value": "5c5f06b1c686d4335bc44f3d6bc1f57959085129c75359156eeb70237f4c4882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879440, "uuid": "099fd508-24aa-418d-8f89-e32a415cb9cd", "comment": "Malware payload (SnakeKeylogger)", "value": "cd1df1b01c84e525a582a6bc6f2cfb5cc95cd908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879440, "uuid": "201a5b78-64cd-4e3c-ad0a-7e854458daa7", "comment": "Malware payload (SnakeKeylogger)", "value": "e4bc4e40fd167271274ab7d29787424adad9c044d7c5cafd5f9124f69345691da9a1136a151cddc8f136ed9cd4122b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879440, "uuid": "fcf7c691-6d61-4e05-a949-d89001291a80", "value": "AA849F64AF931F5BC6D8D1FD40C6D166C9A9FC5DC2B2291A37B2CB86FE00544ED2C286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879440, "uuid": "08e72a5b-4600-44e8-855d-b0cc9e1467ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879440, "uuid": "2637505c-2d11-43a0-bb2c-44536d5d2ce6", "value": "3072:tiCsrHmDhgBdafeLmCdF/dBotTnxDHQzFZ4HsajDNb6FX2t:n8H3m2LmSd3gnxDCmsajDNuF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879440, "uuid": "c4232148-9552-4797-aae6-341acacf8f28", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879440, "uuid": "39b7a0e1-6deb-4289-b854-002755a3036b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879440, "uuid": "ef98dac8-4630-4c3c-852b-4a8eab7f7ab6", "value": "4Z114AKS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9568e0-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818028, "uuid": "c51ddf6e-d322-4d8e-98b0-9ff21a777b7c", "comment": "Malware payload (Dridex)", "value": "7f24c364e4f36c53a651fe0080675d3a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818028, "uuid": "847db6ae-840b-4415-a6c3-e70cc0106dac", "comment": "Malware payload (Dridex)", "value": "5c69e9c495336978424326f22d7c6a9a2353ca814954780dcb4f12ddb15647ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818028, "uuid": "92531b94-62d1-47f3-8c77-38fd21c227e7", "comment": "Malware payload (Dridex)", "value": "91153188c65dab79ed27676f356b3b3e4348b932", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818028, "uuid": "de5af2ed-ef65-48eb-bf3f-03894108ba06", "comment": "Malware payload (Dridex)", "value": "91a52dfe6f38a88430c37d3f28576b6eab412e7c7ecd4b7a3a513ee093a2c6b3bb0394da740c6093641c8f993b57437d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818028, "uuid": "40f84206-a6f6-45ca-b87a-87f3ef55b2a4", "value": "DBF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818028, "uuid": "3b6c850d-646b-4625-aa27-83a946b4c059", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818028, "uuid": "c8531ea9-20cb-4396-a36c-e82917ebe0a1", "value": "3072:KiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:JeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818028, "uuid": "a2082645-5b40-4f8c-b7b6-7845084a704f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818028, "uuid": "5d3174b4-a056-4e05-82d8-f04e71d3fcc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818028, "uuid": "8058eb37-427f-4fbe-ac2e-236f68c78d40", "value": "7f24c364_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ffadfb-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621854095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854095, "uuid": "4c8927f2-9a5c-43d5-b2ac-678fb64d364b", "comment": "Malware payload (Formbook)", "value": "938280d1b2ec7e0aa660895c02dcc2ff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854095, "uuid": "38f5e7f1-bf67-43fb-8105-67b71d51096e", "comment": "Malware payload (Formbook)", "value": "5cde1e56ee4822decbfff9e51c429fd04e97635874a476276246210b753a90ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854095, "uuid": "e3e3f5fd-1beb-478d-a84e-3dcc6a15873b", "comment": "Malware payload (Formbook)", "value": "7c8adef595340c93dbba3b052784cdf17f9916e7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854095, "uuid": "4e24e143-e160-4c9b-b22f-658dc34a8085", "comment": "Malware payload (Formbook)", "value": "d7231e6f26d61f91de73cb82c67330abdf1357690d4120f5bfbb39413cd0c380f8bc1e0549831f2a14e1134ab66f2015", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854095, "uuid": "48f36f88-4d09-44c7-b472-d7fc8b0df7f7", "value": "48242308A7A4B13829AA315BFCDD3512C1FE4AFB07D4C8A51B7D82D29D617710E6D3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854095, "uuid": "4d6ca80d-9b41-4985-84cc-574a48e518ad", "value": "3072:UrNSdUfADhjR3eCjC2mwCrqZbQAX5uDXIKZHXrd3AGhN42dTj9josXB5OX7M4PEj:JsADNROCG+rQPkKz3A+/TJPxYZsaQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854095, "uuid": "8e68df13-6902-468f-b2ed-6efecb2e308c", "value": 228443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854095, "uuid": "29a7a814-8986-4d33-a0d5-402bddcd0621", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854095, "uuid": "232437ce-4e6c-49db-b6bb-189e7756b217", "value": "938280d1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5215234-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854198, "uuid": "673d21f9-f21a-4ded-b2b7-e90e55959f8e", "comment": "Malware payload (Dridex)", "value": "250119c670069afa673e9e555e9baa9f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854198, "uuid": "8e607cdf-fe44-4bc9-b8c0-42370a835c6c", "comment": "Malware payload (Dridex)", "value": "5d01a1aa1aa6f17293fcc4b704f439b4c816533e42fc3acd6d58270c89ee6444", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854198, "uuid": "5af0c451-8511-41da-9e81-fda9571c36c6", "comment": "Malware payload (Dridex)", "value": "0b22c7e5ab391781ec0d9df79d0d20779b53c49b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854198, "uuid": "3b2f8848-bcf9-40c8-9ae7-0438a4c4f012", "comment": "Malware payload (Dridex)", "value": "332e1ee46d35961cb52318bb8f75bc766b4c9a12e09d3258e331b0c6e464ecf98bd028b91186dfad606772c36318ca08", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854198, "uuid": "00c0c79e-5f45-4b8a-acf3-ac09aa563320", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854198, "uuid": "ca121e4d-5203-46a7-95bf-d142d00c18af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854198, "uuid": "5175be41-8bdc-46bb-890e-e0b9869cd8ed", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854198, "uuid": "70186eca-7260-4ebf-945a-b13b6ad1fbae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854198, "uuid": "7a7885df-9500-4883-a21a-765c91f082af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854198, "uuid": "c2bb8994-b3e4-4053-8efa-00b9242ea9e7", "value": "250119c6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284940ed-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871168, "uuid": "f104690d-04e9-4e9d-b36f-2e058b1bcdd6", "comment": "Malware payload (AgentTesla)", "value": "97704fad57b0c195e2b3d7fbc5d56ff0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871168, "uuid": "092e72c0-2443-4fe3-83ee-2cf69b73ad5c", "comment": "Malware payload (AgentTesla)", "value": "5d3809f060dad680e40594da333d32d185457f70cc1197c5e99dcdb7c40cf380", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871168, "uuid": "fadb729c-af0f-4ca5-96c7-4329ad924568", "comment": "Malware payload (AgentTesla)", "value": "9db389c06deb6e40ef418ec3e45765427e845bc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871168, "uuid": "38172d4d-25b0-4973-ac0f-b6a461226ca8", "comment": "Malware payload (AgentTesla)", "value": "58283a71f92734cfe1fdb2db3172adccbe8c7f2f6d9b47b4c7b28b47cd2f3f3364c7dbeea79de9860607ff3136de39fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871168, "uuid": "171104dd-af63-4245-b536-41e4b842c1e2", "value": "4765E02C256EF126C2ADC27946D4503BE590D7377032FE29ECC70B985B19E81BD9227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871168, "uuid": "256b0094-6e07-4814-9599-6d960e14d14c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871168, "uuid": "55047426-1d03-4962-8cd9-b8ffedbdf6d1", "value": "24576:WBCwki+U4TMzoLSpzUelIuHPQXjIz10SYNP19i2eGA+z64/I9Zp:WBCwXWM/p/l5QEze64/I7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871168, "uuid": "850a6755-e66a-4d04-bef4-b373f475c8e3", "value": 1476608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871168, "uuid": "9d0ec9bb-2840-4ad1-ba10-f82e6737e87e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871168, "uuid": "0ced337e-ee61-459e-9eed-69de0851132b", "value": "New order 5563#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c35003-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897263, "uuid": "6c397397-0616-4de1-a920-237c9a1ee29f", "comment": "Malware payload", "value": "ac6f780f6362e992b74cf404d32acbf7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897263, "uuid": "738ea2c2-33de-44ca-a504-d7436f9260fd", "comment": "Malware payload", "value": "5da96174b74a52aa8f33e28b655bafdce2614676beda0679bec7631f9567a05e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897263, "uuid": "d3db337f-8131-42e5-8cac-03d631606d6a", "comment": "Malware payload", "value": "5b2c3aa3020915057336c233bfdc5be57dbd6742", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897263, "uuid": "d8ea22b7-f296-40ba-b581-7fe4ece0b325", "comment": "Malware payload", "value": "5f13e87fc5342dccbdabb97eaba6ebc4f019f684f00b17ca375facc1fd41bbb381e32627fde1d89ef9d36cfb3dbee445", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897263, "uuid": "cc2e1122-6861-4e2b-9ef1-053432127eef", "value": "F3F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897263, "uuid": "fa6ade81-42cd-40f3-91f4-a6a13982e7f8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897263, "uuid": "82712cf5-87cc-48ad-b462-d8bbda866269", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897263, "uuid": "02d9eb38-57e8-436f-b801-9ec7bc165a14", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897263, "uuid": "edc96c03-bc78-4343-89a2-fe991c5bbdb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897263, "uuid": "f40cf785-defe-4fb1-86d0-ddad81874f85", "value": "ac6f780f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d25bec-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (Phorpiex)", "timestamp": 1621878887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878887, "uuid": "342fe3a3-6577-42e2-9331-be4da276a511", "comment": "Malware payload (Phorpiex)", "value": "92ec0ad5172f3a97d6656b70c111af98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878887, "uuid": "a218b318-bf88-4220-9e74-57c703b56e4a", "comment": "Malware payload (Phorpiex)", "value": "5e31f3d2ad06413f4c3824c6bbe56cf7dffda38cec5bd1b2c0c377718a11297c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878887, "uuid": "98acc284-7a7f-4bc2-a368-72d46047a6c8", "comment": "Malware payload (Phorpiex)", "value": "e15fc1668ccdaf70e5831906191f611136b7ac65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878887, "uuid": "5c1df96d-6af1-43e5-aec5-35cfa945faa4", "comment": "Malware payload (Phorpiex)", "value": "00aa38efbca0b4c22ddc838303a0048159758051d0533ae1a091c89b105b9202b637d31d9a2147601a3907bc8b98355e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878887, "uuid": "0e15fc13-d62d-44d8-b0b1-d96e58c58b78", "value": "4EE1B6067A0142D2E85007F05AB2BA4F56FA5471131554EFF37FA50A6B71321F853B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878887, "uuid": "73fcd4ff-adc3-4be8-8151-e909102a5165", "value": "49f011abe55f432b47dd02dd98d6a2b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878887, "uuid": "ae45dfb7-1ba7-445f-ac09-9be26cffa14f", "value": "96:KXsMZCXR3s3IH/QJs8jCGVO/ZPtboynunSkCtqQ:UsMABXfQNCGyZP1oynWS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878887, "uuid": "efdaeab1-bc1e-4da1-85be-593166394fd7", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878887, "uuid": "a545dc03-04d1-4856-91ba-00c411d99b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878887, "uuid": "fa6559cf-4a33-4998-9e67-270438ed3f9c", "value": "92ec0ad5172f3a97d6656b70c111af98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82b6c4a-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "6868d284-f859-4480-a03c-f8e7187778af", "comment": "Malware payload (AgentTesla)", "value": "605658a6fd1b56a125df193c3b940361", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "237cee8c-a0d9-4e12-a688-6e9a260721e6", "comment": "Malware payload (AgentTesla)", "value": "5f74b97ca7c8e3552f74e34bf854ff775122c4e0f24d0c8a3ff83bed4df3b9cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "2d58b535-cdde-4c62-b111-cc4fe0f2a0ee", "comment": "Malware payload (AgentTesla)", "value": "36049ce625eefaf3fb1760fcb7bb6eae07185d21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872295, "uuid": "dd72fb49-a16c-4de0-9c81-6d2d2d8c0e22", "comment": "Malware payload (AgentTesla)", "value": "5a9990e3cd002b43f3717a8299e50497c35b7d87634cf805dd8866dc89bda774b75d82edf7e45f1c759cb952b4dd9473", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "f4f0aa4f-3cde-4b46-aa86-e97a638cabb3", "value": "0E25692C156AF122E5ACC2784AD1503BEA60DF337131AD55D9E33F983B35E81B98227D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "9c9ff256-8b9d-4562-a8c6-d9845a72e33f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "84e4e761-8d7c-4ed1-b33b-7730646b4294", "value": "24576:7CNQidBWkdGgehb0sOUID75B+W+uNBwZqmswtE:jkxqDOjf+MNBwZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872295, "uuid": "082450ac-88f1-4ea5-88d2-d7cd02a1a16f", "value": 1039872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872295, "uuid": "6963c686-d335-4c96-b0d5-6c0acc5b9d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872295, "uuid": "836bd6b4-18c9-4698-8f48-7dd17c6af39b", "value": "Purchase Order for Urgent Response & Give the pricess list PO0038883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2eb739-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836036, "uuid": "b6d2ed48-bc98-45ec-ae55-8a10147793d9", "comment": "Malware payload (Dridex)", "value": "428db7b207cb245398273f1a11c3f1e8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836036, "uuid": "836349a4-10c3-44bd-ac0d-1e40603080ef", "comment": "Malware payload (Dridex)", "value": "5f98229f016431f8975c6dbdf80ba9a886d231a14d7b0996ea8637b8ce95f6f2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836036, "uuid": "9aaadd65-05c8-4201-bf24-038147fe0c51", "comment": "Malware payload (Dridex)", "value": "c01c46b4b42070ea38d247cdd3ac82cd46041ff0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836036, "uuid": "eab382c4-5a2f-4bc0-8ebb-9ebbc2b87124", "comment": "Malware payload (Dridex)", "value": "42504bce5d621668160df56f25c120d7b4b8603b6378055a013768f7d760d02a6c6de603eccb127e62948bc0fe38bd7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836036, "uuid": "c791afa6-7e67-4c79-9013-452fdd7746cf", "value": "73F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836036, "uuid": "21c87578-dad7-4fab-9905-4b070eb01deb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836036, "uuid": "7b64c53a-3026-4f29-816f-610b2bc020cb", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836036, "uuid": "96b539cc-8f91-4331-b461-9879b5165b32", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836036, "uuid": "d0243d93-bbaa-452f-bc26-51e6d4ba448d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836036, "uuid": "5bebad33-4326-498b-aac4-99b7dcfa6ba4", "value": "428db7b2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b0ec11-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621872477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872477, "uuid": "fb64a950-eb73-491e-bbab-e6204119e7e2", "comment": "Malware payload (SnakeKeylogger)", "value": "bf171afc69f665a45ec78b77c0f0d92f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872477, "uuid": "96568fda-6849-4974-9fc2-5f291b283c3c", "comment": "Malware payload (SnakeKeylogger)", "value": "5fb6fd81a3fd4d132c9b420e1f3edc2cec08ef1d81aa7be528cb1cd94c889aa5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872477, "uuid": "f414439c-105d-4ac3-ae79-e11ff3a910a7", "comment": "Malware payload (SnakeKeylogger)", "value": "4072866b533dcf35630fc5b3697913b212e5d8d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872477, "uuid": "2fbf0adc-74fc-4f63-b78a-18a8730a2c97", "comment": "Malware payload (SnakeKeylogger)", "value": "5052688da063c0cce1bcc8f585cad35d4370b26fb86d009ff7ed66f5b9174d86163d250b87702bb3b0c05f2cb1598bae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872477, "uuid": "1a691db7-cdae-4b1f-98a9-be366bb93d80", "value": "9B159C2C506EF126C1A8C27946C4843BE590DF377132BE69ECD337995739E81B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872477, "uuid": "8daddd71-83c9-4894-8a76-73c86081f725", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872477, "uuid": "001e5885-ddef-4e43-b474-86b43e2e0b50", "value": "12288:e3KUBCvPqJWxov9Egsv3UnkTd4DllkZJGxJPl9opMDw4SFmuXy4YfK:PUBCvZGEB/UO4plIJMFlIlHbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872477, "uuid": "9eaa3c82-5c13-485a-b588-649483e6220d", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872477, "uuid": "e5cb164f-3454-4761-97ec-40be5ef566a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872477, "uuid": "a88a757b-e326-4bc5-b4b3-6fcd4d2f6dd7", "value": "Pago May_Adjust_0114 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403979da-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890106, "uuid": "adb91ed2-3cd7-4f6e-ad4e-467f093944a3", "comment": "Malware payload", "value": "b13884e8fe4d010f009d61156f0f9934", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890106, "uuid": "126f4415-d90c-4a06-9d1e-732630af6669", "comment": "Malware payload", "value": "5fe6cb6e45b4df7bad6db234036d4c99232458cf2f4ebe9a41c95bb41472ec65", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890106, "uuid": "ed04308a-f6f6-459a-a4c6-5ba9ee651005", "comment": "Malware payload", "value": "c078837e811b3e7b576164e2e1894583586de015", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890106, "uuid": "f2b53942-356d-44b5-9433-4a16e0e49232", "comment": "Malware payload", "value": "8e40091c5e48a1739743dc940ee45b6c736f3e38988c4270448c3aac5177661e047648001cb16ca8a612d83875414098", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890106, "uuid": "83f62a55-4fd8-4165-b239-56a610f2faf1", "value": "B3059E32F7A08437D1672AB98D9B56945C26FE103A34EC462BE41E9C9F353817B2B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890106, "uuid": "be1a0615-17d1-4100-a7a9-07022e8f5283", "value": "7173dd0bd0ccaed951e4a48d6d854c14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890106, "uuid": "dc5e4464-3e81-40a2-9b0a-46f7ae5e23de", "value": "24576:FXkqSDMHKR+ENns1af2b35WeHocqi8ORE:Nk4sP05WeHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890106, "uuid": "cfe6e52c-16d6-4cbc-a53f-3853fa9096aa", "value": 861366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890106, "uuid": "d367ab0e-fe49-4f70-b630-592b74a85c47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890106, "uuid": "139cfeef-679a-4b5f-a908-44bf9b8cfc02", "value": "b13884e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64918c6-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893713, "uuid": "746ee06b-28f3-48a4-a32f-4adf7cc8be77", "comment": "Malware payload", "value": "dabc38e571cc7500f923f828926c33fd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893713, "uuid": "4d9466a3-fb75-4feb-98ce-2de8a44d1c50", "comment": "Malware payload", "value": "602e117c711ef5253196594075668111554580bc62211cbfa9ccdd9dc66d18e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893713, "uuid": "16e10cf5-8c4b-417f-9ac9-4ae74ef453bd", "comment": "Malware payload", "value": "365285b15b8369b307ff09126f1d71d2d7ad7af5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893713, "uuid": "9a694680-803a-4886-b144-5c3f54a39faf", "comment": "Malware payload", "value": "2697ad5f25ab0a31414aeee0f00206b881849cb1c0e358ccf3f35c431efa2d28bdeadde8556361748a547caad9dc0721", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893713, "uuid": "415ccc43-a7ce-47e5-9c18-0ad5865aa3e9", "value": "91F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893713, "uuid": "8d7b03f3-1a87-4023-9d66-0ed53196aace", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893713, "uuid": "e0be8f39-a627-4cc2-b7c3-bd6d77ed3d04", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893713, "uuid": "071f0658-85d8-4ade-a82c-cbe74f7bb1af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893713, "uuid": "839134f5-83ac-4e6d-8141-860a00c239fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893713, "uuid": "9d8fa1e5-9823-497b-9489-5e5d0445866a", "value": "dabc38e5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51365eae-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621868660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868660, "uuid": "56ab68b6-f6d0-46e5-83a6-01e18bd9964b", "comment": "Malware payload (RemcosRAT)", "value": "2f1af0f26afc7b8b417bbf83e8dcd088", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868660, "uuid": "9caa94cc-0bc6-470a-884e-368d59ae8a75", "comment": "Malware payload (RemcosRAT)", "value": "603c100eda0ad1e8c6db03bb77dd72ee872b1b10e8f86cf255fc399eb7413a9d", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868660, "uuid": "12d2e994-ad41-4075-bbab-c6439b36f1ad", "comment": "Malware payload (RemcosRAT)", "value": "f5b4e2cccb39a113ad62101ae3cddda9ab680990", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868660, "uuid": "c2e0253d-db62-4992-a261-e8f81beb5ffd", "comment": "Malware payload (RemcosRAT)", "value": "e2d74a9dfb0731a22fc0495d8530b43b342d9a1f96ca9a2e575049abee9ece194ee4dc84f342a327c5ba6be4dbebb0cc", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868660, "uuid": "0d54c219-fa62-48cb-bca6-3b0d90c42fff", "value": "9B842374CA164EFBEECF5FA3E54DAF3CD7E17E5290B1AA3514B28C220983648758950C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868660, "uuid": "06fe78ab-5ee6-46a1-8a6b-9d349a9cc45a", "value": "6144:pPoVS+DhpzJLMuDYFBV3wfuYIEr7CZk3hLUvBF39eRIwBXSYIMFiIAqBUFlCO0vg:BwhpzJgpiIEr7COlAn39OIuXSdkivqQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868660, "uuid": "107d599a-8f7f-4bee-b1ac-485e319a83da", "value": 387231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868660, "uuid": "939988f7-5223-4a4f-b45a-958f4ef715a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868660, "uuid": "ba8ac464-d276-4698-b416-e834baece59a", "value": "2f1af0f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7536ae1e-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843380, "uuid": "7a1106c3-8656-486d-9b5f-8585913df2d9", "comment": "Malware payload (Dridex)", "value": "d785dc2f05e6713b0c3d3c149373e544", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843380, "uuid": "047368bf-cc17-4f0e-b247-f662c3264164", "comment": "Malware payload (Dridex)", "value": "6061d4d3dbf04a99092e12b77ccf0515b881c9af202eb1a576ceb7c3bee24e37", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843380, "uuid": "61e1e9a6-0e98-4f31-91c9-6c126adff468", "comment": "Malware payload (Dridex)", "value": "a007beb0a7f139b730ebb449997066fe8043ce10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843380, "uuid": "888c160f-f690-4733-8e63-3eab0077d88c", "comment": "Malware payload (Dridex)", "value": "6f31d9cc3dc8f8a58edf3cd1ff68182766f3b8d2ac1458bb9497d8f5eda64f106667c0bb80094cc159bd8ad136b89380", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843380, "uuid": "45a197e7-c776-4232-adc5-9bb7ebc351c3", "value": "6BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843380, "uuid": "48f4e319-4e3b-49a5-b5e0-c38c8ad5625a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843380, "uuid": "4c365b50-f108-4959-8f14-5dcd754273f4", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843380, "uuid": "06a1e9a5-c0a0-456a-8d01-24d76c043483", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843380, "uuid": "3ed47adb-009d-4d47-9d03-8046edac23fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843380, "uuid": "655c4785-74ec-4e69-8218-8c7de5749675", "value": "d785dc2f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a8f8e5-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879371, "uuid": "7d257f6a-6ab4-45c0-be11-820add7cf7cf", "comment": "Malware payload (Dridex)", "value": "ed0d81ec99792f111985674dd4bcb65a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879371, "uuid": "f153ebae-9a7e-4f16-a2c7-6ce477be57f2", "comment": "Malware payload (Dridex)", "value": "60da1f515188d1fc18c5e39910e83723a9be24e2221a7f5d0af7e850c8175cd9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879371, "uuid": "95d1bc49-5c7a-473c-93fe-3025ef33c5c7", "comment": "Malware payload (Dridex)", "value": "b7ec866f5c2e3fb69ab06191c52c3e855a2e9c3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879371, "uuid": "a5df6f13-6377-4f1b-ab42-720bc006088d", "comment": "Malware payload (Dridex)", "value": "fb41806f092db9428791795df5c736017579ce24586c5b73f1341c50203329f9298820ca27bba1bd67d92873adff06b1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879371, "uuid": "ca192973-9ec4-4894-8581-376640710409", "value": "D2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879371, "uuid": "8cfdea29-b2c2-4cde-9373-01bb8f12e6fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879371, "uuid": "88893898-7347-4b0f-be6d-1f2e6f6c71db", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879371, "uuid": "de7516f6-1340-44b4-b899-ffedee658283", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879371, "uuid": "2ecdcbfa-a263-4307-848c-6c7abb4d5b53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879371, "uuid": "444cabe1-436e-4709-9ec3-125df9f55971", "value": "ed0d81ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78030055-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Ryuk)", "timestamp": 1621861423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861423, "uuid": "a564ac6e-f7fa-49d1-a9b2-db816f2822e8", "comment": "Malware payload (Ryuk)", "value": "662855171d4d584db3f36a4047a855f6", "object_relation": "md5", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861423, "uuid": "aed5e930-15a2-4c2c-86a1-bea3b9c0ae42", "comment": "Malware payload (Ryuk)", "value": "60ef0ca5e6e7d62a7750cfe1c0b08d473cb19a6817a799f035ac56e0d27ce3df", "object_relation": "sha256", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861423, "uuid": "e0a00e77-0108-4943-8cb8-b3d9d231d302", "comment": "Malware payload (Ryuk)", "value": "c9e3193313e39ec9e9acc86701fa61441a2a6f52", "object_relation": "sha1", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861423, "uuid": "74e563f0-7481-4f8e-9ac5-bc5f2a7b5d72", "comment": "Malware payload (Ryuk)", "value": "591e15218a0bbf62a10f460aced1d70c6caa404541f1523403fd3a269a52f71bcd647d4a64bcb1bde455509356b9b444", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Ryuk", "colour": "#C903C6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861423, "uuid": "85849962-0f9d-4b7d-8833-bb0a2a9a8fa8", "value": "2663124E60D6CC154BFBA8629A413817B7E78A682F91BECF226975BC6414C7C0704ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861423, "uuid": "3772d19d-8c55-4fdf-9634-6ba3a8f4523c", "value": "1536:SM9xZCJxLfWujArCYikZ9cQarg7B0oyx6a4ymnyMyTEh:lZ2Zfx8r7Dy3rg3M6Amnyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861423, "uuid": "dc487451-977f-4af6-b3f6-1ca107c40afa", "value": 69675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861423, "uuid": "e5d6627c-be47-431e-a346-ddb0e19cdd53", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861423, "uuid": "d7e1dd5e-e86a-4a51-bc9e-42d728faf74c", "value": "66285517_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fd86fd-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843245, "uuid": "53b45ec6-9a3d-4449-87dc-e4a771614984", "comment": "Malware payload (Dridex)", "value": "066a97b79859e4a9b42f21f64656498b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843245, "uuid": "f89ad534-d5fa-4b8d-92ba-a718591a5ec2", "comment": "Malware payload (Dridex)", "value": "6105eea68b2894d40dc30a0fe11cb3d0d411b7f5a4b6091b11f017ed6aedc348", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843245, "uuid": "94213759-b6a5-4c29-8695-0dde57241c50", "comment": "Malware payload (Dridex)", "value": "5d2e2f1a6509f12371a42f679a8fe25329f07baf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843245, "uuid": "763010f7-c6de-484d-8351-24eb18405f81", "comment": "Malware payload (Dridex)", "value": "c831ee8846e39ac8744b6122136aa0bff5668df9221234a258ec037bf173b1b76026f1734684c40c4577dcd8da6127a9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843245, "uuid": "a22909c4-b5c9-4f35-9de9-d49e2bac10b0", "value": "67F3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843245, "uuid": "48d253b3-fe4d-4347-8408-ec3ac47554c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843245, "uuid": "22a190a7-8f39-45c8-9ce9-6541e5cd9113", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843245, "uuid": "f7519767-7a41-4aac-8333-6268f546feac", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843245, "uuid": "cc9c619e-a945-4577-9f62-11862e9fd369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843245, "uuid": "b6a5fc88-a810-4812-be08-bc61c94eb99f", "value": "066a97b7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae02f79-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1621868247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868247, "uuid": "bbc63484-9b2e-4de5-8ce9-bb733ab1d0bf", "comment": "Malware payload (Hancitor)", "value": "794995a67f64c10b5c7e308752f01972", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868247, "uuid": "cd0384f6-cbfa-4e04-b5f7-a4094094e926", "comment": "Malware payload (Hancitor)", "value": "612baab908e34385010c29700980c517832358268381c13d6987dad3b122f927", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868247, "uuid": "2f64d359-abf3-4426-b542-c939cc6b10bf", "comment": "Malware payload (Hancitor)", "value": "4b3668d98ef3aa71e468d2e533213c7a3c47cf4f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868247, "uuid": "3a6c1332-9f25-4f86-84e2-0001427c129c", "comment": "Malware payload (Hancitor)", "value": "ccf5fec44cbcd2ec9dfcb13af34353bd9589945d1217a866fe87532b71536fef04bd3924c2ccaa6cb35b1f451990a136", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868247, "uuid": "87f528b1-3b26-4f86-a4d6-5a3a27635df9", "value": "25D24A14D902D0AEC4B241FED2EB555E653CAD22235904F352C7B4BA6FEC4C77A3A12B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868247, "uuid": "90bbfc67-ef02-4b37-a8ca-31d0456b485e", "value": "57265d838ef6737ecad7f941f2f02016", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868247, "uuid": "d1e8f6d5-2455-4cf9-b7d0-6d1c25af021e", "value": "384:6ALci7KqOESXvZioqMWFDNs+Qbruy/nt+TkV0eyRTGDh/efD:6ALF1CvZioEmbJ/n8TQLyM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868247, "uuid": "15c49134-6faf-49dc-982c-5899a80546dd", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868247, "uuid": "045a9cc9-9398-4f9e-929b-8275f97e10d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868247, "uuid": "aa39ef5e-df88-4665-9c0d-ee3aa4479e7e", "value": "180000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472e5c57-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843303, "uuid": "a4977fff-687a-411c-9d14-20752f68e697", "comment": "Malware payload (Dridex)", "value": "9166b0feae369894d87bda40a36f1e46", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843303, "uuid": "4728446a-804c-4f90-85c7-002abd41bd4c", "comment": "Malware payload (Dridex)", "value": "63297bc759e4eb6fcb8618f58c18e07d1858531f5f4c8f610c23017e9412d426", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843303, "uuid": "56335a7a-d720-4b65-8541-4ba2bcfb06f9", "comment": "Malware payload (Dridex)", "value": "535916b5d32d32f37e55fbcbbed1aec4306e2cfa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843303, "uuid": "01e3edf2-2c7d-4f9a-bc6f-54d68e371f04", "comment": "Malware payload (Dridex)", "value": "c974540a9f719eed441bf5049a0e8122ed3ee1db8c4a081d5e3ca03d65b546347eac63ec635e21d73b37d8fd58233c1d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843303, "uuid": "0ffcadbe-abe9-43ce-9088-33eb6a9584be", "value": "02F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843303, "uuid": "a94e6457-57f2-4956-b776-a0cedf78501d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843303, "uuid": "a02b79c0-c757-47dd-9f5b-2b63e168ea46", "value": "3072:IIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843303, "uuid": "ebc8d7dd-366f-4128-8c31-474a25255993", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843303, "uuid": "486dfcce-03a5-4c1e-b58f-c96ad14c6195", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843303, "uuid": "59d4fa4d-f2cc-40a6-83f4-08af48fb84af", "value": "9166b0fe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03660803-bcc4-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621883562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621883562, "uuid": "deb7b454-8cc5-4e5d-8f93-685675f9a8c1", "comment": "Malware payload (Quakbot)", "value": "3b774af065663b878812a6348db243c2", "object_relation": "md5", "Tag": [ { "name": "biden48", "colour": "#BA7F7A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621883562, "uuid": "6cbe4fb8-4e3a-42c1-9a34-de4881dde300", "comment": "Malware payload (Quakbot)", "value": "633bfb902a56f619f30acc9c3394e4336a07659442187b8ce42d094e143f7ece", "object_relation": "sha256", "Tag": [ { "name": "biden48", "colour": "#BA7F7A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621883562, "uuid": "bda7005f-d606-442d-9fe7-c4491658966c", "comment": "Malware payload (Quakbot)", "value": "668bd3d398fd8d1c29764355ac2a357bf73d061d", "object_relation": "sha1", "Tag": [ { "name": "biden48", "colour": "#BA7F7A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621883562, "uuid": "deb6797e-423d-43f7-bf5c-b39fdf2e8dd1", "comment": "Malware payload (Quakbot)", "value": "086545c5708ef69a92da19ab9e2e1666e1b978c0a5c11c91662f81f61a380e2a0c4e35757245566538f14a2afff8c13c", "object_relation": "sha3-384", "Tag": [ { "name": "biden48", "colour": "#BA7F7A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621883562, "uuid": "62319d0a-61f6-4351-b2fd-51232919ef92", "value": "DC0402ADBAA1E516E7A408F3D4401B831CA71FC747873C6B7B12929477F0DB742C4A9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621883562, "uuid": "9c86a2f9-dfcd-412b-ba94-7aa3d9d8bbbb", "value": "3072:s01evjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OH1Zs:Tov8cKSsYodBXC0YnW49MarG19Ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621883562, "uuid": "1e5e3c75-da4b-4daa-98f6-df6fd8c31665", "value": 187804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621883562, "uuid": "39b59edc-9cfb-4815-a7db-c2fce3ed29e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621883562, "uuid": "24bb3147-e068-4967-bc84-bfb04857ab42", "value": "Outstanding_Debt_121064830_05242021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17af55ea-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890038, "uuid": "5540a5bb-c1d7-48e0-aba6-442892b4d0bc", "comment": "Malware payload", "value": "70ef51d8301676f8aed7588beefe33bc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890038, "uuid": "fa4a4eaf-1faa-4ac1-9bfa-7841ef91b045", "comment": "Malware payload", "value": "6353a370f2bdca2c78e989d9af6b6dd51e07f0761371f0bd3b13abcf505268ca", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890038, "uuid": "a2e145fe-0c7c-4bd9-bd9d-7284b17f80bf", "comment": "Malware payload", "value": "e085f5968fabb8b3a580cbf6af778f4ac8956f31", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890038, "uuid": "a79c351c-f7cb-4b77-8d0b-9e7cf54a9155", "comment": "Malware payload", "value": "c41a7ea50854e87d4daaf1cc2119d22d2407ed6afb974b917edfb4b6b2030d2947e1f6044d4a7d9b90ff4cccdcce6c16", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890038, "uuid": "a338ea1d-c67e-4de8-a585-7c9ad483ea35", "value": "4AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890038, "uuid": "21aab595-b417-4929-ae8b-cf5861bbfc26", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890038, "uuid": "70673d3e-2945-4e9f-9aab-2bad24a85a78", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890038, "uuid": "718f7d6e-6343-4cb3-a1f8-110f26d216c3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890038, "uuid": "58bc703e-373b-4926-a827-6ba971a23bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890038, "uuid": "836f0c54-627e-47cb-ad6e-66456d326f7c", "value": "70ef51d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bef5690-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836117, "uuid": "9084023c-2f28-437a-b8a4-f110af8b1788", "comment": "Malware payload (Dridex)", "value": "934dfc655b6da927cee0c091a3fbf8b2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836117, "uuid": "e031f17f-e856-4d14-966c-011a31125f09", "comment": "Malware payload (Dridex)", "value": "6356eb9dbf684c1aabfde4aa1fd8c4f29d01fd9599246b26e4bb979540b337a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836117, "uuid": "9b2f7144-5ef9-41aa-ada0-ab91fa50e4c8", "comment": "Malware payload (Dridex)", "value": "e12443c0253a8383f16bc0775381e0e549aea72e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836117, "uuid": "aa3dd067-56ea-4435-9e1a-bfae70a017a4", "comment": "Malware payload (Dridex)", "value": "67c95fb6605464dbf6cfacd0cb858a8a823852ee9c1e3d5ff1eb66515c0e7d3c21c8837fc27780c230f0d4ae7776ffda", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836117, "uuid": "2d4d4d15-808e-41bc-a365-71ffe69babc0", "value": "A6F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836117, "uuid": "a35aa4d8-4230-44e3-bab8-f64cd5dc9b1a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836117, "uuid": "f7be4fd3-4a0c-4d05-be3b-536eb4c1fd0b", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836117, "uuid": "8a7b7a7b-3462-4abb-b460-9253ad2ae9ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836117, "uuid": "49e7c7d9-dec0-4b24-b137-a92c6556d298", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836117, "uuid": "3a11b437-2b5a-444c-90de-b407ea55b87c", "value": "934dfc65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01da62e0-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850488, "uuid": "bf4cc8fa-da1f-4ca6-a7e7-3d636b2fdf0c", "comment": "Malware payload (Dridex)", "value": "b460f82fcb8d1fb90af6a5cbc82ea242", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850488, "uuid": "f5bd9f3c-4752-435d-950e-f29a5c42f332", "comment": "Malware payload (Dridex)", "value": "63d1f93752b053f7b8020e842f6ba3a2e140f5d07a9c86c68770bc46d8d405b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850488, "uuid": "2aa1e29b-009f-461b-8d68-fc51db7753c2", "comment": "Malware payload (Dridex)", "value": "36fedaf0f918b865548bde3261f8a80f9b179ed5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850488, "uuid": "24564961-d8cb-437c-b465-69b651b8a2d2", "comment": "Malware payload (Dridex)", "value": "7c6e92bbf54f8188281e6050c4258e019de3dadf294b077578c56f9f73f99592ecf5e5d9603fefe36a393fad8e4eb2fb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850488, "uuid": "ae61b55a-181d-4146-a582-e8170356591c", "value": "7BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850488, "uuid": "ba7fbd51-9f16-45c8-9e4f-d508c20653b0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850488, "uuid": "5b3cd4ca-91a7-4d96-a7d4-564e293f4d54", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850488, "uuid": "048e27fd-9224-4569-8282-e5b1357db198", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850488, "uuid": "01aee0fb-8d4b-4669-90c7-6fbdc81a29b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850488, "uuid": "e33cf577-0a20-46c0-8253-d880c63977a8", "value": "b460f82f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7d60548-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886495, "uuid": "7c1ca7f9-d360-4ce0-9b6f-ac9384406886", "comment": "Malware payload (Dridex)", "value": "712d62626e89df778a9f455b709e5196", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886495, "uuid": "164b5fa7-d3fc-4f35-8da8-5446a7526695", "comment": "Malware payload (Dridex)", "value": "6462f2a3357b76beba50c05f8578e9c09fc6cceb6386d8ed0a1862a1ecf0d1c5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886495, "uuid": "d5e3ddce-6ce5-4144-9bda-3828b5bf02e1", "comment": "Malware payload (Dridex)", "value": "345e5e5ad24f12c2ac6b963c7e4c9b72407b0d3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886495, "uuid": "4edc4e0c-d48c-4fc1-b872-dbe3b782d39b", "comment": "Malware payload (Dridex)", "value": "8dd9c1343967bb0825d293023fefe7a79cb8387fd1ce6bcd09f44c4bbb2f0d8c27cdfe69396bf0dafe1f2975eb0d0af6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886495, "uuid": "af64a450-b761-49c7-a1c9-5745a38ddad9", "value": "DAF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886495, "uuid": "df2cf9d8-6a75-4e7a-b107-358845777d4e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886495, "uuid": "49fba676-6093-4745-875f-e2e74be19148", "value": "3072:Slpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Slo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886495, "uuid": "9c28bd54-8af0-4784-a12f-7b231c2f4f58", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886495, "uuid": "532ccd00-82b9-4c79-b30d-eacb06042697", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886495, "uuid": "e3d4bc37-28dd-424d-827d-a88a8c168940", "value": "712d6262_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86baf326-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872615, "uuid": "f3c3dd78-626e-4af1-9796-45e53104e050", "comment": "Malware payload (AgentTesla)", "value": "d574910c86d8709ac0dd2341adead2f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872615, "uuid": "a7348255-bfda-4f4c-bf0b-95dc3438cb90", "comment": "Malware payload (AgentTesla)", "value": "6485fe25a2fdc831f092d76ceea2fb69e335c1cebdd3bfffb832469b5c8938c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872615, "uuid": "20c1479b-ded6-4cee-b762-f4933dc71cf2", "comment": "Malware payload (AgentTesla)", "value": "640e11bf72c49c86c6764f71f0eaaea58f437cc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872615, "uuid": "bdda4b34-998f-4a6e-8754-8dc4de42ceba", "comment": "Malware payload (AgentTesla)", "value": "77f9c1c43d6426713a21c5bcd6125f116c0a8608b685a08fe19b53fcae9c6845061bbd17c58b6f2f5a81d695198f382f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872615, "uuid": "4a95853b-a687-4a0c-8b30-9f72a7dd2b51", "value": "1064BF2C5814BF26D163C2B9CCC5F4EBE1915F56B4210BCE5BDBBB32722722E24A116D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872615, "uuid": "bf82b8ac-3ef6-45fd-96f0-bd2f3f6a53d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872615, "uuid": "0b92e7d0-567a-4a89-b63e-49ea299553fb", "value": "6144:AMa1XQhf/888tFyBtB6Ux3pfiDlQfJaBmcFAlQImZB+grQIvc7n8dQSOALR3bAIC:AVEtiZv+IBZs6nhFoQTRgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872615, "uuid": "a6e764b9-92b3-4f3c-8bf3-3946e18254c5", "value": 326144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872615, "uuid": "9361ffa1-4261-470a-8203-782354e50703", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872615, "uuid": "76208d08-e223-4c5b-9e6d-401b45f7c940", "value": "ConsoleApp6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99c8d11-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857668, "uuid": "cbd9e56e-f84a-41f1-9412-5ffad46f4d00", "comment": "Malware payload (Dridex)", "value": "10490ebc07c7500b58de7bf4dbe7f9fb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857668, "uuid": "1a60796e-7ccb-4c25-9689-3243a7619f16", "comment": "Malware payload (Dridex)", "value": "658673fcb5c74c89d3a50f3feaee9aba17462fd37e3df52722538e8022d538d7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857668, "uuid": "aa0f20db-9673-4a63-9072-9fad850570b3", "comment": "Malware payload (Dridex)", "value": "d33d871fe87cc82613a5648c9c79aa2c4291fd94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857668, "uuid": "4a5e79b4-5560-4393-a46e-692f95cb405f", "comment": "Malware payload (Dridex)", "value": "8046eea0da57b32c245b08bd89ecf78ca756605c6748d0a7002017cf9e64de0f761c39295a18dde8fa83701dbfbf74a5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857668, "uuid": "2f9ff6ef-1960-4f11-adfc-1702fa6ef92b", "value": "51F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857668, "uuid": "18ba31be-58da-4a23-99d4-2950db044822", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857668, "uuid": "4c53d5c4-4011-4e3f-997f-0fc712600622", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857668, "uuid": "4ca06193-5298-4f3b-ae9f-42d04838da41", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857668, "uuid": "dde12054-2686-403c-be9e-f884af729304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857668, "uuid": "f99c5bdc-3af6-4ad6-b6c7-dd83588cec46", "value": "10490ebc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e99eed9-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854079, "uuid": "e665af21-5689-4a4c-9c4e-7935c8b56140", "comment": "Malware payload (Dridex)", "value": "1f30fbf62b4e8ea5d45b64539886a561", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854079, "uuid": "9ffd2c38-418c-4e44-9b82-1cfd25970494", "comment": "Malware payload (Dridex)", "value": "65a35b6d615b3edbfa94143cddc014263f4fdd428f3cad7186275ffb94e2b4b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854079, "uuid": "0024fcc2-1cf7-4561-98f8-bbb67320fe0d", "comment": "Malware payload (Dridex)", "value": "64fd732baab819011e13919008ca5339d2905fd9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854079, "uuid": "664a5de9-7274-41aa-8088-ce95c97f63a6", "comment": "Malware payload (Dridex)", "value": "6e7352ae575a1f33fe378fe62cf12148e663ffb57ece409f6cba523396da684082a5f5f4114126fac850274f8688026d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854079, "uuid": "a14ca7c0-07b8-4a63-8564-153deb998146", "value": "BAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854079, "uuid": "9e406686-b533-4cdd-8f8e-677e9345b1e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854079, "uuid": "04bf7be1-b708-487c-af01-b6637f3622eb", "value": "3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854079, "uuid": "68a8c9bb-6df9-4795-ab99-695d5e7b5441", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854079, "uuid": "9b00ef10-ea2c-46e9-830f-e783ba6e9712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854079, "uuid": "07730257-59b0-48f9-b629-6723080c6a75", "value": "1f30fbf6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58df87e1-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814556, "uuid": "03b23001-2ff3-4562-be9f-7c720dee4365", "comment": "Malware payload (Dridex)", "value": "e90c02d85d6888a8e25de4d90e4dbee5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814556, "uuid": "8ccf0c2b-baa6-452f-9803-6d6b1d91f7b6", "comment": "Malware payload (Dridex)", "value": "66b13227b044836813f242cf659b5e9cdcbc8bbae29c8c49fa416ce3e8b0d696", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814556, "uuid": "3e90708f-7a48-4265-b06a-41fa75633347", "comment": "Malware payload (Dridex)", "value": "25ab9af7b7313132983d690d3a2ae60229c77e31", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814556, "uuid": "c24940ff-048d-4727-9251-b59146ec46af", "comment": "Malware payload (Dridex)", "value": "533cd18d78d7542a040bda08877a09bd0dd088385921ba4b423cb3562fe9a76c2d33a2bfcf5b93470e3951211729233e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814556, "uuid": "38ab32ae-cc41-42c2-b4c7-9b2df1dfff6b", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814556, "uuid": "bfd1a4fc-4026-48ff-9af1-c4dc9fa377e0", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814556, "uuid": "5a494b4d-299f-4bbf-a4ef-4b1b2b1ffe53", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814556, "uuid": "98e4c5ac-de8b-4583-837d-218095ff05c5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814556, "uuid": "9e707f4f-8683-4ad9-b734-518c97e9bc38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814556, "uuid": "58c9f4e3-2f02-4cf4-921f-29f25c32cf01", "value": "e90c02d8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9045e44f-bc8f-11eb-875b-42010a9c0053", "comment": "Malware payload (StormKitty)", "timestamp": 1621861035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861035, "uuid": "8e569af3-c59d-4909-b7f0-dd55d335b9be", "comment": "Malware payload (StormKitty)", "value": "71814562770d49f4d356110eb2a31956", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861035, "uuid": "2f1ace01-9524-43ee-b6cb-2f155670dee1", "comment": "Malware payload (StormKitty)", "value": "66b82396793d2236adbb51f5ac863e2fa7c3792b9aa234148403b14c4c5bdd23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861035, "uuid": "28356c3d-5403-44e1-ae7b-0542deaab8e3", "comment": "Malware payload (StormKitty)", "value": "8941f1c1ac8c81531409b16b3369aad6d7d4ce99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861035, "uuid": "e0797847-2f18-4a3f-84b5-1eb23a14956c", "comment": "Malware payload (StormKitty)", "value": "4c5eb625f30b0056fd1e882d31bf6cc6ad91d4d8b9dd99403cf9a8072717c640ffe239e560e7f8014db62b2e9cdb23e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861035, "uuid": "6cb26c65-214f-41e9-8748-017134b475b5", "value": "73058E1C116EF322C1A8D2798AE4C62BE950EB377031BD1AFCD72798175AF41798127E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861035, "uuid": "501dbb0a-3fec-490a-924d-a3352208346f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861035, "uuid": "329a5488-6149-4f0a-bc28-4c630b52690a", "value": "12288:4cEBCLrVVDf5l67NiiLgLQiVjmm62kC+PKV6O16H16z4uI9To9tjUrpFfE:2BCLJVDRgiaOjD6a+o6Ok0z4J9J1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861035, "uuid": "1618d234-5c49-497a-aa59-ef50fe6dc13c", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861035, "uuid": "f408f59f-7295-428a-86a7-fb56b0b373f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861035, "uuid": "33033026-39a2-4ce1-a942-243efaad9328", "value": "Shipment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3080ca-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621876065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876065, "uuid": "db4abcbc-a7b8-4e5a-934c-7c54686b6cf3", "comment": "Malware payload (AsyncRAT)", "value": "97550448476f3fd388f6add162b3661a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876065, "uuid": "9dc90f3f-7235-4f93-8dc1-a6abfb6d4c80", "comment": "Malware payload (AsyncRAT)", "value": "66c0b451b44a4d48908efabfb6ddaf2d04f8a7f3c592179ac4a8c8b40baef3fc", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876065, "uuid": "bf2a84c2-00fa-4756-9de1-0b4f39a48774", "comment": "Malware payload (AsyncRAT)", "value": "72c3c3ee8e6d46e48e76d34b1274d3dc52acbb13", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621876065, "uuid": "3d473859-98d6-47b7-9e70-6c6a73b000e1", "comment": "Malware payload (AsyncRAT)", "value": "9b07e916f312041b1b328fc7674b69ccd9c9c7de52ea01c205c992f3f6d7ead1c3d64eaf15d5c7fab0a5d863dd1563f9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876065, "uuid": "6c4e34f5-96cf-49ea-9249-25f2aec75753", "value": "6EF312E4112E929ED814FEFD3E178254C2ADD642B78611612DD4EBEF0F72421293FAB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876065, "uuid": "da1c6c8d-7d79-4235-8de8-6acc33ffd104", "value": "3072:HwI7cS3u2nB5SThwMfBCjhDlADbhiR1xXBOHhYs0F0/gVYC18o6W7Y7qW:HkS+2nB5enJCAD9iR1XO/jYeKTqqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621876065, "uuid": "0ca31fef-92d6-412a-8917-71efd9a3a8ba", "value": 161160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621876065, "uuid": "cb717534-2a8a-4020-98ad-acc2e167b9ff", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621876065, "uuid": "1b08f1fc-ad97-4845-af22-a586110d8d74", "value": "97550448_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9341bce-bc4c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832434, "uuid": "907de508-a887-4273-9580-aca9d0ec9602", "comment": "Malware payload (Dridex)", "value": "4ccb549d4f2e810edd8c8a04cb85263e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832434, "uuid": "0a8c462b-b305-41d3-a190-30f3463f0e0a", "comment": "Malware payload (Dridex)", "value": "66d52f483140e17deb2902c558ab2e0344cba4ed8e9833e6d3ab33bff48e6489", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832434, "uuid": "c52fa926-7994-4b14-b107-755192bb2447", "comment": "Malware payload (Dridex)", "value": "ab8a6cb2bfa3db66a695ae20f3bac9a913dcb116", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832434, "uuid": "39587fb7-8d1c-4fe9-aa16-554f5e835548", "comment": "Malware payload (Dridex)", "value": "8a06967dde373b5fc114cf3dcbd38dcaadd08cdb7447df9a0201d0806c1b35538a556bc0fa6f9a829acbbbf225a624be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832434, "uuid": "a95e873f-17d4-4d2c-ad05-63d49947243d", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B4A1174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832434, "uuid": "d6ff8ed6-6969-4cd0-9071-94f3f2155e1b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832434, "uuid": "156454c4-a62d-4e5c-bf78-85e14f8250a3", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832434, "uuid": "6520656a-4699-4f70-9660-3fdbbfd4e96e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832434, "uuid": "63b82c9b-2b70-469d-94fe-8bdf5b489e2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832434, "uuid": "d520dec9-bcc3-4aad-82c9-ae22206b4578", "value": "4ccb549d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c488b5b7-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857686, "uuid": "3e04cde5-e43d-49bc-be80-c703a3422394", "comment": "Malware payload (Dridex)", "value": "60ccb3ed9575ec6b3505ebef52054ab5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857686, "uuid": "4e904c82-c02b-4d9b-8563-0e31025d3a4f", "comment": "Malware payload (Dridex)", "value": "6754fdf11593cbd0607123ead6d6a6100424addc8d5060c1b1d107205078831c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857686, "uuid": "8e3c2414-304c-45ed-86c8-973598d280b4", "comment": "Malware payload (Dridex)", "value": "426e631d7b678006ab2718774124f34582e2746b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857686, "uuid": "7ea7cb32-cc32-4bcd-9d9e-08547c2b3a58", "comment": "Malware payload (Dridex)", "value": "8f65495b6e42aa444e31c26df88b7e89059effea5e185395b27c9510f30a96795948ba4076fb60dddb13c2d5a0105058", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857686, "uuid": "8fa57a52-83ed-4eae-8f64-45a1fc26f92d", "value": "DC04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857686, "uuid": "6ea71a0a-9f3b-42cd-a699-0bb1ebbee06e", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857686, "uuid": "3be207b1-0ef6-420e-b999-eaa183562eef", "value": "3072:GV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:GV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857686, "uuid": "ff60fac3-132e-4413-adc6-b8ce4759a355", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857686, "uuid": "f5f79935-cfc3-4106-b2da-9ed32c2950a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857686, "uuid": "81dc416f-b60d-4a29-a2c3-a0aa4191a011", "value": "60ccb3ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d655b242-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621865018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865018, "uuid": "c4300cb9-2827-4de6-bca9-41239d0d2627", "comment": "Malware payload (Dridex)", "value": "e7cf1e7ecbb774a4fb856eec2900dd4d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865018, "uuid": "857b4339-60a9-4472-9b92-e415f6b5efcb", "comment": "Malware payload (Dridex)", "value": "679ce26daa6e8b4963ae13e14d186fa39f08f4483bbc2c6153f232ee10423faf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865018, "uuid": "f5f17fd6-2d9b-48ff-8488-40f302444542", "comment": "Malware payload (Dridex)", "value": "d6727cf9b2b92d1bc4c026c17464dae5ad8007da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865018, "uuid": "bb059316-40e2-4810-9753-3d9e6494631d", "comment": "Malware payload (Dridex)", "value": "f888d12e7d00ff3e829d255f1d54079c84afc2f74f962f8b5a9e20fedd05293b158a8ba11f958f7c2423633c0f06bfe2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865018, "uuid": "3d4537cf-b145-4453-865c-9ba2c33c9bb6", "value": "5D04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865018, "uuid": "2fdc8961-0f23-46fa-b057-e9885df3fad0", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865018, "uuid": "b208906b-1619-49c3-adeb-0810303b45a9", "value": "3072:fWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:fWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865018, "uuid": "67fc2748-60ae-44ee-87f3-f7743a3b03e0", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865018, "uuid": "0f0d679e-ee7c-49e5-8211-26e05f89e0c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865018, "uuid": "14955e56-ecba-412f-b067-462dc41c8c51", "value": "e7cf1e7e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1e7b4d-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861321, "uuid": "2ed4e4ea-4054-41df-8db8-9bd94637f0b5", "comment": "Malware payload (Dridex)", "value": "e93efb9d1e250271b995de21c0e2e33b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861321, "uuid": "afda3cec-3448-4565-b70f-42651e837d62", "comment": "Malware payload (Dridex)", "value": "67cdd6aa66534be65163e1b6c33c63bd50dc465db67ef31d64569a9b01c6f013", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861321, "uuid": "911d51dc-640a-4fe1-8dcb-130f46811c3e", "comment": "Malware payload (Dridex)", "value": "71a3be077a0633eb90e084316e0157f8870d0a62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861321, "uuid": "9d934594-6814-4525-91b0-5e15d15d3387", "comment": "Malware payload (Dridex)", "value": "2cc3bf410f0738f340137198a33f38fd0644b26e264d7e2a0164921d7e5704836fa42e9da520df0879f8fbfe7be05b10", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861321, "uuid": "2a6781fa-7323-4abb-ace2-bd191b720b9b", "value": "A5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861321, "uuid": "3dcad2dc-a37f-45b7-8702-4779cdaaea1e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861321, "uuid": "c8573232-003c-47f6-a647-777db9f6e045", "value": "3072:emNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:vLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861321, "uuid": "82d1a72c-a4f8-4b1e-a729-318e54252b20", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861321, "uuid": "db652f4f-fde8-4867-bbbc-ec8a94f17466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861321, "uuid": "5aa4ebe1-2d5a-4171-98fc-fc573855a9b2", "value": "e93efb9d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc855c9-bc44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621828842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828842, "uuid": "7da02949-a6dd-4893-949b-8dae03b704b5", "comment": "Malware payload (Dridex)", "value": "da6db83d9dee17990f1fad64b9ae55cf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828842, "uuid": "0eb43fb4-9cd1-4288-b85d-13e4e46e3a9c", "comment": "Malware payload (Dridex)", "value": "6832e07822a84df6ea821e446a71a2c8f522cd7282951bba9ce15d049080f831", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828842, "uuid": "6120d144-4c30-45c0-bbb3-a432e56f06e3", "comment": "Malware payload (Dridex)", "value": "756d0180983e3ad06e8875081f413fff8a126bdc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828842, "uuid": "f50e344c-aed6-4703-9eea-cba140eeff89", "comment": "Malware payload (Dridex)", "value": "20c1d91ef527b606d521e33aa14ab08043cf43fbab90f06511e3a84d3fb28a1fb79116c55ce0a38eadf2c329c4f72c97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828842, "uuid": "2332acfc-0c4d-4004-8dbe-416adc7484f0", "value": "BEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828842, "uuid": "35618ee6-1c48-42ef-af52-05bcededa52b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828842, "uuid": "f045a995-383b-432b-90ae-5a64a58e0db7", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621828842, "uuid": "6c90732b-bd30-44e1-8449-df4a4e5330d8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621828842, "uuid": "05574bf7-9c3e-4dcc-8fdd-19ddcd6a66f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828842, "uuid": "f6bf16dc-9f00-4b66-8197-2dc93b558f57", "value": "da6db83d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfdcc073-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857732, "uuid": "57fed005-0122-4cb9-a102-e5c5515e0274", "comment": "Malware payload (Dridex)", "value": "692981e7c7e2a35e45534ff09bfd212a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857732, "uuid": "2ff102ee-7e3f-4214-94a9-6a4b321b78a2", "comment": "Malware payload (Dridex)", "value": "68d36b92eb024db6d3d454d90fe59941400c46d06d13a6831e826711418edd20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857732, "uuid": "f3b5a1ac-7e40-4abb-8b8c-813f390b990e", "comment": "Malware payload (Dridex)", "value": "cfa30747b6e0692e08e04faba23b76320c2f1155", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857732, "uuid": "228d8ecb-70e5-4243-9657-dc61f55c38f3", "comment": "Malware payload (Dridex)", "value": "0388b71c0cd8e0d5b400f331f3d102e0faed26057966a8b914cf3ceddf6709bfdde751247093fce6bbbf0bd131792f63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857732, "uuid": "f3d08c26-a1f8-4c39-8552-770cbc34bf61", "value": "4DF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857732, "uuid": "81d1ae0f-6687-4787-a0d9-f85909eee5ab", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857732, "uuid": "346ce3ff-83e8-4ff2-ac21-809a40332d41", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857732, "uuid": "e972c0f8-c605-4df7-8cfa-fec83042703c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857732, "uuid": "0adc9da5-b220-4243-9d93-3b5febc6d58e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857732, "uuid": "f11a3433-5015-4323-92ff-99fb72f89325", "value": "692981e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69bdd20-bc52-11eb-875b-42010a9c0053", "comment": "Malware payload (ZLoader)", "timestamp": 1621834953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834953, "uuid": "120b94bb-981a-4cec-9c0e-00d9b125e0cf", "comment": "Malware payload (ZLoader)", "value": "571f6d891e07da6d9e3e136ca8681a47", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834953, "uuid": "63103a35-5853-449a-a074-04e805e917e2", "comment": "Malware payload (ZLoader)", "value": "699fcd73045f130ed6d9f790ce57323049329082db6b0d34103e822283b93433", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834953, "uuid": "453bfd32-6bfb-41a0-843f-bf4ecb340057", "comment": "Malware payload (ZLoader)", "value": "d3133c5364561ffd30df1d3a5bab8b6049851e98", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834953, "uuid": "196b2694-6dbb-4db4-945d-1216a5634d5b", "comment": "Malware payload (ZLoader)", "value": "37775a35e2e41e59380b73255febc8bd531fb3e6dc4f1db3b7a40208ee9b3e4ec227e60a6244a29701a07878e2a5e110", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834953, "uuid": "2e4f3670-da4f-490a-becb-8fb5bb926dd6", "value": "B054D5C6AFA3CDB8CB00E5308CEE46416324EC15496D87C73649F6357EF9E34AD56298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834953, "uuid": "8fabc944-fba9-468d-86e7-b789ff719908", "value": "6144:7k3hbdlylKsgqopeJBWhZFVE+W2NdAWSUEZtY55lf402AZvinblt4kS:xUgE34ZAU5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834953, "uuid": "e3f55363-688b-44ca-8eac-40f5a287df5e", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834953, "uuid": "851068e1-6ec3-4380-9af2-30afd2e6feb9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834953, "uuid": "78b330c2-0aa0-44ed-ad6f-c73f33216680", "value": "172112-05_17_21.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ad682f-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897254, "uuid": "804ab70f-264f-42f8-97b5-d600112d6076", "comment": "Malware payload", "value": "573725b87cbc6be609f8720fe407c389", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897254, "uuid": "25c75905-bbc7-40e6-92d6-785c6c3c51af", "comment": "Malware payload", "value": "69b4cfce178fee57cfc6c2ce7f44a866fbbe15f9cfa3e6f041a431c8fcb29798", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897254, "uuid": "29a3a2e4-ba37-441b-9d50-1d43ce0592e7", "comment": "Malware payload", "value": "36a908c1ae43d49596f459bb15005acc12604d34", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897254, "uuid": "2eef7a43-930d-4222-b2d2-8f2cdda5485d", "comment": "Malware payload", "value": "ebbe7e58982a442a1604e7eda19133c2e97c1fee9c6bfb32f9eb174d9603be545dd4ad592971d160acd7a47524f23e71", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897254, "uuid": "44e1e1bf-9217-4897-bf81-440cf8722436", "value": "87F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897254, "uuid": "f4b4e87e-428f-45c7-96e8-918732992fde", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897254, "uuid": "4340811f-9407-44ad-8870-76a13b7ae586", "value": "3072:gmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897254, "uuid": "8f0dfcd6-751f-4b6b-bb53-f4199bf43494", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897254, "uuid": "39e457cb-894a-44ee-a3fc-92c1fe529d5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897254, "uuid": "6db70344-8830-481c-97d3-be17b7c2599e", "value": "573725b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed1d5cc-bc3f-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621826458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621826458, "uuid": "e113efb7-f042-487f-999b-7f486db9fe04", "comment": "Malware payload (RemcosRAT)", "value": "77cc59fdd27a5740f052f18c4cf8560c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621826458, "uuid": "7dcd54a1-0b01-43db-8b4c-1288694cca88", "comment": "Malware payload (RemcosRAT)", "value": "69b7fe61ae71ecd658c9747a572a8eaf7f0f49c745028e37c0ff3464c9926889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621826458, "uuid": "6ad1853c-bed0-4d6e-a75d-cf1c018f1b9f", "comment": "Malware payload (RemcosRAT)", "value": "a862fef0a8430be5f6dcf2a783fbaa1192d21c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621826458, "uuid": "7f077fb3-d579-48df-ad7b-a343bb8adede", "comment": "Malware payload (RemcosRAT)", "value": "0577639bfd3c743c0fa7c01b5b0ec063f3479fce019b0518ced823f69b801260321eada2c92e8b40bd7ff3f4e65c4f27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621826458, "uuid": "9ee711f5-8402-41e7-ab70-4604adad8366", "value": "4A9338B2B191FB79C85D83FA9721147C1545BD3C2B7A5947D3C4022C3AE79E68B20B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621826458, "uuid": "0a112228-cb3a-40fa-82dc-fe1167d9ce4f", "value": "c0aa42a4533845b7eba74fce6ed7746f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621826458, "uuid": "60e57190-9d31-448f-a3b6-cee99bf9eeca", "value": "1536:INFf/qTERZz/QeKQb1yuVZo7fktk/0r8ax9Pbm9G2Xo8:gZ3zfnZCydbm9GIo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621826458, "uuid": "536cb8ce-ab23-4d86-b028-7632f8251303", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621826458, "uuid": "b2960424-92ca-40b7-8984-2a12a4defe52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621826458, "uuid": "4eae82af-8c93-4a88-8da4-04a6184b28e0", "value": "Contract AHNAF-1289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00111322-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821709, "uuid": "db3d41c0-dfe2-4039-8485-d3390375b289", "comment": "Malware payload (Dridex)", "value": "72608e9ea2988eec34c02fe1d2d3152f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821709, "uuid": "a9565a73-b9c2-43d0-9a85-79da0d2ae91e", "comment": "Malware payload (Dridex)", "value": "6a3023a93ac37d52008f82ccfbd9d91c8312543bf4e83b628fdcee091b93a1df", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821709, "uuid": "d611d62f-f1ee-48c4-91d4-a7b8930dc5f9", "comment": "Malware payload (Dridex)", "value": "6d1cdacd8b9ee542a6816bee9221d048eee69161", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821709, "uuid": "c14674dc-7a4c-47b4-b678-18ffa49d6209", "comment": "Malware payload (Dridex)", "value": "a35e7b64e2a11dcf4ef65ea4f04e464f3efd7c0d5c781c5a9ae26d8de605c7d04ca937a8502c5832e8b51f172f595f3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821709, "uuid": "6f281848-c581-44e1-b795-2012ea6bcb0d", "value": "65F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821709, "uuid": "58749148-cf78-42b4-bb09-1af8eb3d79bb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821709, "uuid": "972d1c8f-bc0a-4f84-a582-b905705e76af", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821709, "uuid": "97c5f7f6-70f0-496e-ba1f-834e6c25322f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821709, "uuid": "3387ea8e-0986-4da0-9a86-55d779c51261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821709, "uuid": "768de9ab-6f4a-4f69-9567-3749632162ff", "value": "72608e9e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95acf039-bc44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621828831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828831, "uuid": "3fc1494b-6b6c-49b1-81be-ae9184b2ca57", "comment": "Malware payload (Dridex)", "value": "479a835a63cf8023b67b8f2f0cbd7a50", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828831, "uuid": "753000d6-5b9d-435f-8dc2-3150131f1d7a", "comment": "Malware payload (Dridex)", "value": "6a3c1566652649018ca52ac0372b57020e3af22bdc3f818ded4f99b458db3ba0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828831, "uuid": "c8ce59cd-c952-4236-93eb-e93210b9cf4a", "comment": "Malware payload (Dridex)", "value": "cd33d1aff057df1dca92fb27fd11e4993b71d821", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828831, "uuid": "de16856f-19e9-454e-b96e-49ff9e776ce2", "comment": "Malware payload (Dridex)", "value": "7449f226985258824261df6ffaf76cb038b784bcf9145df22ca500c980272d03f0eac080712f30b5daad342f03381018", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828831, "uuid": "d7b3ffcb-bf92-47b8-9c29-4816b746252e", "value": "37F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828831, "uuid": "26a1f457-1363-4653-b428-1093e337b046", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828831, "uuid": "c62e3964-814c-40aa-84f3-f53d7871fa73", "value": "3072:tiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:2eAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621828831, "uuid": "86723756-2526-4ab6-8173-dd3a1329d785", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621828831, "uuid": "4c6b4cc6-603e-46f9-8e81-41d3114924bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828831, "uuid": "e5284eea-567c-4aa8-8c09-849e805a2070", "value": "479a835a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2513af2f-bc63-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621841957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621841957, "uuid": "7dce03d3-8bd3-466b-b0e2-c56a2176b73c", "comment": "Malware payload (SnakeKeylogger)", "value": "2b65c1f24b0c470961f9590e6513edc7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621841957, "uuid": "beea2c94-17e3-4629-abde-252b17bbf69d", "comment": "Malware payload (SnakeKeylogger)", "value": "6ae674e6b8ce231440c0cede9419ee1889c55529231b79a28c7ecfb276ca4174", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621841957, "uuid": "caf56164-f50f-40b5-95c8-ff42349fe230", "comment": "Malware payload (SnakeKeylogger)", "value": "583ace520e7387fc9563005c54b31df2db86914d", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621841957, "uuid": "c151405e-a9b7-4466-93f5-8453f19de3ba", "comment": "Malware payload (SnakeKeylogger)", "value": "b4fa737dc2acdc6868796cefb420ecf66ea993cc569213258138ce59549ef79c8c510b6d7ac732b32ab5062bdbdd088b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621841957, "uuid": "6dbcaea0-52e4-4a5b-bc2b-64b82cdd951e", "value": "410533DDDBE9DB03DFA0DCC059110E773ECA8D6BA52E8A1A85DEA007D8053BC746918D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621841957, "uuid": "7b0436ce-1ac6-49d9-b52b-436fa4fb18bd", "value": "24576:VQmFd7ZhO4w5yADnwnei4EPGm38EKq077nfkD:VQ83O4wTD2ei4g82077nMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621841957, "uuid": "21dccff3-56cc-493e-b6d6-e03df57c59c5", "value": 800948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621841957, "uuid": "5fccf329-1fae-41f7-b129-75c3bb5ccc04", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621841957, "uuid": "6198908e-b669-4ab8-8e97-15af900ade69", "value": "PI_Signed.tar.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab0394a-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886634, "uuid": "7956e725-eec7-4dd5-a1a3-081817d8f5b6", "comment": "Malware payload (Dridex)", "value": "eccc8872eca93818bfa78b4f2084dfca", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886634, "uuid": "eb93ead8-3d2e-48f0-8762-d90fc3ef3ecf", "comment": "Malware payload (Dridex)", "value": "6b1a7ccdbf78ab9d25fafea787199e8c9696000b20823121a64882f373306cd0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886634, "uuid": "0fd05563-5ec3-4e2b-9872-6f645ede78df", "comment": "Malware payload (Dridex)", "value": "385af81a8593d28ea01d943bafefcf42a0b96c98", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886634, "uuid": "5460c061-c647-4aca-95ae-837ef6578e61", "comment": "Malware payload (Dridex)", "value": "127749f8a77447e1278e2b5c19a5bb8fb0e3e26d9927bd133facf382e217cb1879518c7298995bb872b80282f199011c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886634, "uuid": "5bfdf288-2bcd-4d0b-b447-61267ebdad50", "value": "23F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886634, "uuid": "9d8b1513-8cc7-4161-800c-41997843d8bb", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886634, "uuid": "2d411635-b06e-4ee1-9135-86e30ed47811", "value": "3072:OiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:FeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886634, "uuid": "aa9d3535-41f3-4d3d-845d-efbf51f48b6c", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886634, "uuid": "2e25f1bf-3721-49ce-891b-eb69e3504c32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886634, "uuid": "38320d87-5f02-4d41-92a2-b3c1d4df62bc", "value": "eccc8872_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df32756-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "cfccc6e8-270a-486f-89ba-25f445b84803", "comment": "Malware payload (Dridex)", "value": "34064ae6fdeb47dfcdfd9878663d6755", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "d35e96cc-fd75-4d0e-a68d-7ee7cc0ea6b3", "comment": "Malware payload (Dridex)", "value": "6b7c1da9ed1f5a5d2c18c80b28082463a0d605318c08252608ab30ad5cc4ad41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "54fdc586-ffd7-4a4f-9f6c-af283d9b114b", "comment": "Malware payload (Dridex)", "value": "cad7dceb521cfb2d982504ec2638cb9aa93a1e86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836120, "uuid": "45c59b3c-3666-4a79-9a55-54fc2e9befda", "comment": "Malware payload (Dridex)", "value": "04da3690ccf22dd19c4d8e2ce3683457c56d869f7fcec68f07297f15395b13519093e6982ecec9e476080ca169ab32f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "b6d27ae3-3b31-4cca-a87f-fed7374321a0", "value": "AEF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "db33c92b-5106-4079-b828-fa9d2fb18f25", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "676ee1a0-5783-4a5d-ae38-28f4d62578af", "value": "3072:Llpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Llo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836120, "uuid": "d62f20f9-96c2-4da6-ab85-a012905b2041", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836120, "uuid": "a7b75fc7-a47f-4391-9666-2fd931bab994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836120, "uuid": "69182798-ac66-4592-ae6c-64233bdfd192", "value": "34064ae6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f322f04-bca4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870052, "uuid": "1ae6bb8e-a847-477b-8272-e82caa25620a", "comment": "Malware payload", "value": "467d61e3c5235f8e4f3136d7225fe416", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870052, "uuid": "9353a426-3535-49a4-aa63-f07f95a5715d", "comment": "Malware payload", "value": "6bcc69902f72ee0e956cc769e2bac0eb88c72793c5504556e40be97056432cb4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870052, "uuid": "99904250-955d-45c8-9540-1c2924b9fd12", "comment": "Malware payload", "value": "33652bb489f5cab2037f2e8c943fa7d7246a0ab9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870052, "uuid": "56e5e83c-43da-44b5-9759-39fdf3759d4d", "comment": "Malware payload", "value": "9409a115024590544e89d853a2c38b1b361761cb6be1aafa7c145ca893442d82e0cd2cccd3972d4c4b437e095a731da5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870052, "uuid": "fc077294-1f1e-485b-b1bb-d6a9758ccd74", "value": "BDA1A4B45E791857CD5B8AF9D4B4FE2702F7F14889CB0A50336DF9B01B7B3500A62680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870052, "uuid": "2c4b1f06-c8fe-4a6f-887c-5bb208a1aa98", "value": "96:pEwGRa1K9cieSQ9qahmhkxKNjVEGUy7hPQ5dZZ1H6solw+sbsgaLBi68:1sUK9ISQ3kC8aAj++sbZaLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870052, "uuid": "2fa49897-a6db-4ad4-a2eb-8f1e20785ac0", "value": 4687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870052, "uuid": "f4f23bfe-c337-4bf7-9bda-b03e36ae00ea", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870052, "uuid": "29df7ef1-e07f-4314-8f75-ccacfa1e5127", "value": "RFQ-376754.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdd829c-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621838237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838237, "uuid": "4f6ff688-69cd-4fba-bc55-798db1435260", "comment": "Malware payload (RaccoonStealer)", "value": "f1e78fdd461d0b441aaa94c749b4512f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838237, "uuid": "681a0133-f525-42d4-875e-a0028fc42c41", "comment": "Malware payload (RaccoonStealer)", "value": "6be6474fb53815e6c4227f83c675ee60aa638e670e78230b5a0d3d175e25863b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838237, "uuid": "16d292fe-2e18-4662-ad58-b79993ffc0bd", "comment": "Malware payload (RaccoonStealer)", "value": "85a6b515c5d589e5e827ed7c2e2070d33ad51c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838237, "uuid": "d81308b5-2372-4245-8429-f42f5db981c4", "comment": "Malware payload (RaccoonStealer)", "value": "1890f7c309972a398c1e408390676d801cbffd144e1e9709a9758157cb34191a3151db3ca702f7d5f5bf7f293f5131f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838237, "uuid": "704d3840-109c-4769-8a3b-dbc99ef8a197", "value": "88C4D02066A1C038F1BF12F449B69274752A7DA25B3050FF12D63AEE5634AE4AF3174F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838237, "uuid": "f5d60fa7-a368-48ee-86e5-e13f30fa1fa8", "value": "eaf6c398deaaa81e3b5479039cba0b97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838237, "uuid": "ff987f00-765f-457d-a261-8811a0bf6392", "value": "12288:eEBKgO/YlDuj2WyyuqhL4MsYX7LTjR/tYbvUiauMNJX+7/AqIXsL:TBKDjwqhMMsYX7L/6pauiCAqIXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838237, "uuid": "20517f41-50e5-421b-bad2-79ded699398c", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838237, "uuid": "62752f81-ba9b-4446-89a4-e6c333cb4fd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838237, "uuid": "d5539320-008b-4454-bd83-3ec7c483b6a6", "value": "f1e78fdd461d0b441aaa94c749b4512f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56db390-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850386, "uuid": "7f34112e-674a-487b-9cda-ae2983f98aea", "comment": "Malware payload (AgentTesla)", "value": "328946c937e153aa85a5d48754b7009d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850386, "uuid": "a6607b32-24f8-420f-bf7a-94f0d7262504", "comment": "Malware payload (AgentTesla)", "value": "6bff25a8218e1ef959dae91897a7315cc42e96365b24064dbbfc9cb90f7c7e26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850386, "uuid": "bfd65b31-3eae-4df7-acd3-14bbb8a962c2", "comment": "Malware payload (AgentTesla)", "value": "ec3bc40ca424f8fa3267c9b71b93efb40bdc0c25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850386, "uuid": "5ac6284e-c220-49d5-89ab-a8e4d44258b5", "comment": "Malware payload (AgentTesla)", "value": "3a069021bbb7af739530ddbe7de17a51737756bf09e445deca836bd2ac7c93526c6829c603201300f5782b363b06d4a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850386, "uuid": "f64de6ab-68bd-4549-a32e-69e5815a189e", "value": "4AB4239D9B7A042F874E87F31DB4014A6E3DC2673BA2857DA74F623D8B0D809A1F5472", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850386, "uuid": "1a9a8a1e-ecb4-43ef-9814-b665763e7cbc", "value": "6144:rn4TGmonerDNuJK4ZGKfubHIh2PtQMlx5jbtGQNj5ByoDj6UQ68Mqq8p2qoN2o+0:rnjnqpuJKgGQubfb5tf1W8qVieOCZ7Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850386, "uuid": "bc330f7c-f266-48ce-aa06-90e652786202", "value": 498295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850386, "uuid": "d68e4669-e3af-49e3-af39-f24eb74f933d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850386, "uuid": "0124b42d-f8e8-460d-939a-14670b2f3dbb", "value": "Email Copy - HAWB No_ PSGA00688171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896acdb4-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872620, "uuid": "8dae1d14-fd65-4cb8-8a0b-6294f5ac02ff", "comment": "Malware payload (AgentTesla)", "value": "4472fd9b6943d350b1fa1440a9d5b12e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872620, "uuid": "ecd61ddd-75cf-4a76-b932-7e18564fe30d", "comment": "Malware payload (AgentTesla)", "value": "6c8fba7e18deb79a5ff092bbcef30f6452b64e47971d2f679607b0d01045fc78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872620, "uuid": "6206217d-24a2-4e52-b862-e3d2852cb59e", "comment": "Malware payload (AgentTesla)", "value": "42ebed6cb8ab27284e1fff5bbbc16f7ec1992788", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872620, "uuid": "07d85e93-c56f-4ad6-8cf1-4fc073be2157", "comment": "Malware payload (AgentTesla)", "value": "072958c7533a9e6629c0bee3321fd726f870e63ac08bbc5d98863e61ba3fab94d270c70bf0b390bdb0d08b82054030d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872620, "uuid": "8115850a-564c-476e-b1df-c70d66942d67", "value": "763538DC5D5AF41AC069D27875C440BFD393DF3320B9AAA699C3EBC94717E4078812AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872620, "uuid": "592d114e-0a60-4014-ac37-6e7e4fe57e33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872620, "uuid": "9324605a-c210-4b19-9966-b8e6228cf39d", "value": "24576:DVo/TCFBC54SW9sEbL2sXM9BOVouJVtWKGttXwK4CfLc:9BC5hkbL2jkVxsftXzLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872620, "uuid": "2d730f0a-8c37-4bd7-bb0c-a9bb8b0d0c89", "value": 1106432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872620, "uuid": "d5d6e556-0558-4a09-a5e0-ea9c56b2c6b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872620, "uuid": "9318bdbb-76e1-48b5-ad48-61af0bc2162f", "value": "mCBvNl9Sjgiw3WQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074fad3f-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868536, "uuid": "0dfe0fa2-a85f-4218-9a4d-556992f91386", "comment": "Malware payload (Dridex)", "value": "c93178d20d589042a36a519abbc410a1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868536, "uuid": "43741cfc-491e-4ba4-99c5-bd4bf233d226", "comment": "Malware payload (Dridex)", "value": "6c9e22dde2791031306c375f9192ebb62dd2f8e2f757a7349467a8243bf59815", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868536, "uuid": "322ae91c-b8ac-4171-bc8b-5d1e680dba0b", "comment": "Malware payload (Dridex)", "value": "fb0e4aee655a5e35e99ebe78573b8db94ca67872", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868536, "uuid": "bc1f1af8-e858-42d6-8638-79cdbd3db1ce", "comment": "Malware payload (Dridex)", "value": "2ce09263e82ef9d99119c8d876c9a54a703d2b8eaf271a7b9470a3862e22fc32020ae61d5134cf0bbb0d4d612c3c8f7b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868536, "uuid": "e4bd99be-1e5c-4548-8ace-817493010d1f", "value": "4104E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868536, "uuid": "870e3aec-18cc-4088-8b9f-ebc860a457a8", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868536, "uuid": "41809c6d-e80b-4a60-853f-8a1bd58e3b3b", "value": "3072:kV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:kV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868536, "uuid": "4cb4641f-3aae-47f2-b6ce-de2aae18d7e8", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868536, "uuid": "83f5e2af-3f88-48e7-b1b3-142384138ce2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868536, "uuid": "ea7c6e8b-1c14-4984-81ab-77f4963c3526", "value": "c93178d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955dbe5e-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872210, "uuid": "c470a4a6-4954-4e35-bce1-fddf5260eae1", "comment": "Malware payload (Dridex)", "value": "f6ff8abe47234169e61cb840ba312173", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872210, "uuid": "dfd934a3-7cad-47ae-bb2c-d1b7882546a0", "comment": "Malware payload (Dridex)", "value": "6cb19e074f664f7b3956c8e8ec122db5732d1801eba681a63f7dd1dabd69bba8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872210, "uuid": "e9b23ab4-177e-4f7e-a6f8-231895bfef70", "comment": "Malware payload (Dridex)", "value": "3679e0cf35dfe90c585a3eb6189ee4a25cd5dd66", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872210, "uuid": "5599fdc0-b870-4b21-aeb5-fb5ac6cae5e7", "comment": "Malware payload (Dridex)", "value": "1c7bc0294fefbf8123a08b44e74bf5086aecabbb5670ac1863bd5935e0922fa22d52f797895dd7b99cee123e0d131e4b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872210, "uuid": "8033af14-140b-4276-80e9-a21b8b34dfad", "value": "03F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872210, "uuid": "b576f5ef-84c9-4d36-8a89-45d92e38137e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872210, "uuid": "1c371b99-c026-4cbe-8023-4cc67ecc0bb5", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872210, "uuid": "40bdbfbb-5ccf-400a-8297-dd7e503b121d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872210, "uuid": "abd485f2-b397-4945-9a3e-4b505f1273a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872210, "uuid": "ea026120-3453-4bb2-8603-e4c72a1f53ff", "value": "f6ff8abe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba219a3-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1621837619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837619, "uuid": "3963731f-0527-4d6c-b75b-735f173a9180", "comment": "Malware payload (TeamBot)", "value": "9b3632fa117eb73d341ab07de126904d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837619, "uuid": "52851351-f631-4304-a37d-bbab39ccd375", "comment": "Malware payload (TeamBot)", "value": "6cc9956ed6e36fa513a5fb0a2826196a65fb9ca4d9fa4d9e46d5189e143a0702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837619, "uuid": "734c559a-0da3-4782-8e5c-a719ef9301b7", "comment": "Malware payload (TeamBot)", "value": "cec26638f87b0e7b4521489f8e0cd3ff8c5ac4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837619, "uuid": "1c8acdad-c690-491e-90e1-c9b255041019", "comment": "Malware payload (TeamBot)", "value": "053bea07d9542354c98cefb8eeff922c6a87daabb3425b7748e2ddfc4333235a4a1efa5f8e7284b692a3413424ea9505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837619, "uuid": "8cf5b97a-400a-472f-839e-91fae6013b89", "value": "7F05F120EAA3C035F4BF11B459A98279653A3DA1673050FF62C23AEE56349E49D3077F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837619, "uuid": "2c92401b-7841-4cd7-9918-c106602d34d3", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837619, "uuid": "e70fadea-3c29-4a74-b737-45377978ed7e", "value": "24576:leBzwlrAETvpo/AkwvfiWCs6SfD6sWq9XsL:htAerXiqDHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837619, "uuid": "53b108fd-f2a1-4b56-8ffa-05b9b460d596", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837619, "uuid": "d8c3ff14-8b9f-4706-b50c-57d58546e69b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837619, "uuid": "599cafd7-051a-400d-83d4-46c2efb3389a", "value": "9b3632fa117eb73d341ab07de126904d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988ed602-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621871356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871356, "uuid": "b815f12b-7faa-4521-b772-373951b706d5", "comment": "Malware payload (SnakeKeylogger)", "value": "6e453171854c03a747d6dcd4c1a1fdfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871356, "uuid": "013baabb-7290-4e8f-a145-65e3b1b2fe1e", "comment": "Malware payload (SnakeKeylogger)", "value": "6ce06ad436b9a3d99c6cbbd1f5b746d2a6ddc9fd2957f58e00b9438e9b24d99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871356, "uuid": "99e06391-104e-4f80-868e-4f6bf737292f", "comment": "Malware payload (SnakeKeylogger)", "value": "ef9b06709c26d5c58ea5ebb6a173c4c1543c74c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871356, "uuid": "335738ed-f8eb-44ec-b8ab-97eaeb3aa096", "comment": "Malware payload (SnakeKeylogger)", "value": "06d74c277de9f18ea6515537095c4aa499d68868f6053edb8d384ea9a8e4d7c3665b9ff922452c7bc340ba25f743bf2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871356, "uuid": "c89e52b6-b410-47bb-9ca2-a19971d62c1f", "value": "AE059D2C516EF122C2ADC27D4AD4443BE590D7373032FE28ECD767994B19E81B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871356, "uuid": "ac3c4848-9595-4a11-be15-95850ae56ff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871356, "uuid": "6cf19d28-ca5a-4bad-b2d4-9f2f7f13331f", "value": "12288:gDgBCwAa+F8YUjCg7wyo8RY+CXP+7+m4CzH1E8BXlJP:1BCwf08X7bY+C/+7+mne8B1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871356, "uuid": "171186bc-dd1d-4cad-a2cb-000009213a60", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871356, "uuid": "ccf49b26-b04d-41c7-9778-1647f1ab799d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871356, "uuid": "67ada5da-17d8-4784-8da2-f4205ede1086", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f22f7f-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850464, "uuid": "a2b99bb5-6651-4dc7-bf63-25fc537a9276", "comment": "Malware payload (Dridex)", "value": "6a7c4360818f694d2112fbc5efda7dc3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850464, "uuid": "f28fb21a-7543-489f-93a0-670ac9a6d160", "comment": "Malware payload (Dridex)", "value": "6ce18c6590587cb68e139fef8bfa5e98c680ba99dcb0a35ac41d53f3298d0cad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850464, "uuid": "557494a9-dd9b-4d90-baee-e5044a71d01f", "comment": "Malware payload (Dridex)", "value": "dcccf00b14d46571a0bcf35368568d247aff9a94", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850464, "uuid": "7bdff37a-185f-4fac-812e-1b13667b346b", "comment": "Malware payload (Dridex)", "value": "e421bd89c5b2a5f7788c9d40a95a36f86a03323f46004728e94d8ef4cf4ad6bca0468827cb93c81e88a8933775a5095c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850464, "uuid": "ad056246-7173-4ff2-95f3-a2d1006f21cf", "value": "59F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850464, "uuid": "f0424e73-3c7d-4ad7-a32f-60ca6d9f2164", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850464, "uuid": "2d832428-53fd-4830-9b26-bd37129e3ee1", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850464, "uuid": "fe5aa5bb-4d96-49c7-afda-f1bdebc0c209", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850464, "uuid": "92f02fd3-c603-45c0-9f91-a28dea4f5b29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850464, "uuid": "9338f8ae-230c-430b-9f60-ab6a45fcd234", "value": "6a7c4360_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cb63ec-bcb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621878204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878204, "uuid": "5b4cfaeb-d354-4043-9231-5ba3dadb395e", "comment": "Malware payload (Formbook)", "value": "6cd01e3bfd1e0b2efb791cebc45ae7a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878204, "uuid": "6fdae7f6-09e0-4e20-a73b-70e04f5762be", "comment": "Malware payload (Formbook)", "value": "6d53b16faa7d57ada4a5c9a6db40d57bc992b1525f35e87dded4d9c80dc1c5d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878204, "uuid": "b63fabbf-0ad6-4ca3-abd0-bb1b76dbef6d", "comment": "Malware payload (Formbook)", "value": "2953a5b4ed0012cd6d994f0e9e199aabbac237b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878204, "uuid": "ffcdd685-2cff-4f7d-80ba-b3cd6e25f874", "comment": "Malware payload (Formbook)", "value": "aa6bfbf58cf0cc0b1b32923723bc9e9f6989d43dfe7241f646af6aa98b68b15a9ab421de50e2612ef4d2ec46d029201b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878204, "uuid": "54fa8e5e-993f-4775-94c6-ec9e9ec5b895", "value": "18652350B390914AD85C0974CA22BD205AF2BEA01D10EA9F4EDB3F5E3DB3745254BADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878204, "uuid": "a2e6984f-bd17-4359-87fa-64511936e90b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878204, "uuid": "f8a7ff16-13e1-4471-8baa-09b4e29b2c6e", "value": "24576:rlXdgAF6gwTWajxRbvRfwkW/V4j5WUWQO37KZ5hwWjY:BtgG8DRwv9LQhTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878204, "uuid": "447b649e-e418-47cc-9172-32b9724bab95", "value": 1415680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878204, "uuid": "682f58f2-eb7b-4ddc-b206-563f01926e90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878204, "uuid": "86598c00-2f4f-41ac-9746-d63f1f5cb8cf", "value": "bank slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c052384b-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621850807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850807, "uuid": "2aab8f72-93ee-433b-8e3a-c936470c094a", "comment": "Malware payload (Formbook)", "value": "e89edc057caca569d778e8837096f4e6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850807, "uuid": "99e2a0a2-cd49-47c6-b127-da98dafb7618", "comment": "Malware payload (Formbook)", "value": "6dc206b5eb1c52c0dbaee39ee5a79e03caf69bc82ac8bbccbdcd41f4711fc13f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850807, "uuid": "a30bdbae-6b42-4ac4-8f08-a6e08aa61de6", "comment": "Malware payload (Formbook)", "value": "a6269e5299a399ef8524962918b2b59ed69254db", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850807, "uuid": "5050263d-eedc-4ae9-97a1-9d96ad2dde87", "comment": "Malware payload (Formbook)", "value": "45f4b6a5660dc3954047de8840d2e945eccae43edc3572ae1909f97b1170c5acd3ad614342fb85b87f8288868782f5a8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850807, "uuid": "167e4ebb-7a5a-48dd-b60d-2fdfcd7ecba9", "value": "F4A423D8CB5891AA39B679ED0CF5619ADE31D1F53ADEC64036B0813CA3DD9F05C02EA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850807, "uuid": "d73a731b-2761-4c4f-a6aa-ed1c4f4e8f20", "value": "12288:7p2zStrEienU49embyktSuwpDzTqZWbEO9SsgOswdb:7aJnUTmmkt2fqZ0EIiOsQb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850807, "uuid": "adbd9183-253b-4087-8c58-9a8d7b49e2b4", "value": 477993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850807, "uuid": "a60c602d-d64a-4adc-be17-3422f40c4ba7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850807, "uuid": "2b220320-660a-4679-ba26-831e4e8db0e5", "value": "PO1234EFJL_011LM000_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8870f09e-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854150, "uuid": "2a499227-07b3-4a4f-90b5-0356d7bb626f", "comment": "Malware payload (Dridex)", "value": "1bdaf8de34a88b0849c0e072f88572cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854150, "uuid": "68f67af8-d4e3-4d3a-b6a7-a950a0e171dd", "comment": "Malware payload (Dridex)", "value": "6de6e4b445ca739aed39b0706b89fa50bc81b5706c5191a267df0a645da08996", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854150, "uuid": "cf137b20-6dec-43ca-89d0-f408d7f50185", "comment": "Malware payload (Dridex)", "value": "57e6f6c9883d0a6ddce309cd2b2dcfc0a3e27d44", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854150, "uuid": "fbdb58ee-eefb-414f-8ee4-a8b7475d3fee", "comment": "Malware payload (Dridex)", "value": "2ca9059ddd8e955099cd48daff2f7bf2b0c7cf0090e5898769fb17c3a76e4a91ec002da13340ea8cc7e0b310112f7fe9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854150, "uuid": "f30e5710-b160-4b3c-8de0-2f094c426e0b", "value": "FDF3E00AED9FE988E84C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854150, "uuid": "ef2ed687-9f39-4969-9b71-8b9dd2750d3b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854150, "uuid": "60cc8769-898d-4466-9aa4-7d55412c8557", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854150, "uuid": "de52c1a6-cb47-4daa-b2c8-6639717a9a9a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854150, "uuid": "02adfcd1-ab9e-4a87-922d-f4618c581620", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854150, "uuid": "cbeff49c-41de-4f10-b0df-df2695bb6339", "value": "1bdaf8de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df32697-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821759, "uuid": "1d00aec7-71ba-44e4-a8a7-2e3cd071d8fe", "comment": "Malware payload (Dridex)", "value": "a0e6cda522d6ae1cfa541681ede4d767", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821759, "uuid": "25167979-b3c3-4a7a-a8bf-c2d731b898e9", "comment": "Malware payload (Dridex)", "value": "6eaef890f7a1fe612c41614c073fff84874d138372eabca82dd06d5f6e0e8c1a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821759, "uuid": "fab9f747-23c3-422d-8cbf-bfc69d38f3ee", "comment": "Malware payload (Dridex)", "value": "e30d0a9f874045bf9c1085bc52831813823b85bd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821759, "uuid": "f231199f-b814-46d1-b1d9-e32b786e29ca", "comment": "Malware payload (Dridex)", "value": "c6f7b3de842dee9ac4a4900778eac1536b7860b47ad71ce744e31f2c9710d330675e1427b656c1d614fdc6bf2e96f209", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821759, "uuid": "90b96d88-5f6e-4435-9fee-b300ab98f220", "value": "08F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821759, "uuid": "5a351bb6-1bc1-4b50-a267-3525bcf92714", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821759, "uuid": "e01f9ce0-b728-4493-b364-9c20923af26d", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821759, "uuid": "b634e73e-03d6-44b5-b0ab-07945e2f23ed", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821759, "uuid": "d801852b-addb-4359-918f-0108af9fca4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821759, "uuid": "48b1a909-b836-4e21-bd67-e177de673c34", "value": "a0e6cda5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66fc4a11-bccf-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1621888453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888453, "uuid": "48f22e79-e960-4b06-aa3f-1ef7d9f35587", "comment": "Malware payload (NetWire)", "value": "4bbd1d37cae908a0a5b1b773f1db7d0b", "object_relation": "md5", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888453, "uuid": "043fb836-d194-44fe-b30b-5d186189698e", "comment": "Malware payload (NetWire)", "value": "6eb5d9dcf0f31ae42154c514b72cbb8ad73cc0c2101bd35139cffea516c0e7e9", "object_relation": "sha256", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888453, "uuid": "3c5773a3-4b02-44fd-885c-9f6ef963818d", "comment": "Malware payload (NetWire)", "value": "d2ee9cec361d41fa8143a789d0134aa957c44426", "object_relation": "sha1", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888453, "uuid": "e279b3ce-3159-4d75-ae10-81217229b6a1", "comment": "Malware payload (NetWire)", "value": "1dd9429e196ac50eef408b3bda8ec938d8c44d920f4660eff46821baaf33c3e2047bd498e5931a50974cb6222d619c7f", "object_relation": "sha3-384", "Tag": [ { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888453, "uuid": "c8eb12d7-8b1b-4358-b3b3-23f17b33f170", "value": "04E5602BE345938FE9B435B087B130C2618AD2C3F8E0DE9EA7AD442DD30D176954EB59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888453, "uuid": "8c2c8668-4610-4848-ba7f-12f7277ba65a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888453, "uuid": "e4a05a75-18fb-4cec-8eed-d1c6d21bf250", "value": "6144:sJ2VVwH71VWdosFLBQee2xwtnJ3I+773YswF7TC3ND9S0W606oMJJMAuCNkhT0vy:sJ2VVwH71VWdosFLBQee2xwtnJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621888453, "uuid": "8462426b-1b19-4857-a049-f6b9d74c0df6", "value": 3317760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621888453, "uuid": "a61f5288-5c1b-403e-b65c-94bf0d57c772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888453, "uuid": "b144599f-93c7-4b0e-9e8c-f785e848ddde", "value": "DHL-MPP582XXXXXXXXX.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fba29e9-bc9a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621865731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865731, "uuid": "93e565dd-5451-44d2-950b-0d68a3538df8", "comment": "Malware payload (SnakeKeylogger)", "value": "45208041d2e880375e2ab0a582c9d4d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865731, "uuid": "db5e9e4e-e5ab-4a31-acbc-077aaac6832d", "comment": "Malware payload (SnakeKeylogger)", "value": "6eb82e68c15eb50581f9e4a16f1b9bafb6484eadd82cfddcf73a4222cd2e53a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865731, "uuid": "042b52c8-09e4-4155-8c2d-7bb5252749ba", "comment": "Malware payload (SnakeKeylogger)", "value": "6d7a7f55657d91855cf3de5191ae95416acf1468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865731, "uuid": "dbea6940-b698-484d-9c9e-68569d26534c", "comment": "Malware payload (SnakeKeylogger)", "value": "845f0ae061494fafaf88b844d1d5cd1bf3b86941c94f11f5454d496471f0668c6ecd5eab3f08d1c831fdd36c2c3f242a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865731, "uuid": "5e4f09db-bc19-4cc6-b6c6-646871fc7a67", "value": "FEB4122213489B29FD3E973DA564C01403F4ED56E302FA2D7E5F61A8D453B9B867AE03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865731, "uuid": "38f26b67-bc89-4425-9cc4-88d81a2b7972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865731, "uuid": "f9fa675c-9f40-41a8-ac17-922e3f52d4cd", "value": "12288:rw8jOwVif/qdq0vd8q02wQhyZRC8d3xevKz:U8hiqLgRPFxRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865731, "uuid": "83c3d3fb-877a-4280-8d07-bd06a7824db2", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865731, "uuid": "4cd16489-eec0-459c-96f1-5a4588565d28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865731, "uuid": "77e580d7-8522-4e7a-9d54-a958c56d2dc6", "value": "NEW ORDER PO#42617.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b794aacf-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857665, "uuid": "eaec48ed-e216-4ff3-84b5-53555b56a0fc", "comment": "Malware payload (Dridex)", "value": "125b8d6ca96276f6d25729148d43646f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857665, "uuid": "69a6c544-985f-4e0f-9e39-fe9b1749407d", "comment": "Malware payload (Dridex)", "value": "6ec1e80f2c978485e3a79c14bd101226a8bfa41356f8991e38edaa53fe4c90bf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857665, "uuid": "0dd5559d-b7da-42fb-9872-bc93bf7b223c", "comment": "Malware payload (Dridex)", "value": "9d7bdec6430a859c3882c38bdf739b35426f5e91", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857665, "uuid": "7619901a-2b2b-44c5-b583-2204a60e59c8", "comment": "Malware payload (Dridex)", "value": "c3f23b3dbe56641de8e0be9f98e6b506c8defe8964204543ff635ddc148811bb6f48be7bd1baf5c57426a6c6a33d6160", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857665, "uuid": "d2719034-c92e-475e-871e-dfe7f73a6dae", "value": "B1F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857665, "uuid": "92dc84e4-ab65-454d-9023-523c80487be2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857665, "uuid": "735b32ad-eb5e-4e7f-b1cb-ba700d53f863", "value": "3072:xmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ALc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857665, "uuid": "b0d2f050-abd8-4058-896a-2fc32ad43e01", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857665, "uuid": "0648834d-27a5-4f9f-bfbb-e6796a1c391d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857665, "uuid": "1e0a2b66-19ec-407e-844d-6b0f017327ef", "value": "125b8d6c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3728663f-bc58-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621837263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837263, "uuid": "072e158b-437a-49a6-9aca-c53dd187fe3a", "comment": "Malware payload (AgentTesla)", "value": "33b9b5041f9be187894dfcc07b4c9204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837263, "uuid": "b69a8177-bbd8-442e-8eeb-9da4aeb110d9", "comment": "Malware payload (AgentTesla)", "value": "6ee7ac2fd3126b6996b13b533a8db4f68bef5785388218b9bd93291f83106fce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837263, "uuid": "a04dbae9-50b0-494b-a266-e317cbf26890", "comment": "Malware payload (AgentTesla)", "value": "e0baa9e2eff96f15fa3d3d505eb667e6de09c392", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837263, "uuid": "5f380675-ddbf-46f2-9cfc-d79cf6336cc5", "comment": "Malware payload (AgentTesla)", "value": "7e69d34830dbe3724a4cf3ae4227f31ae362c2637ab605476ff9486322b3568dd6ae3d99c4646855960c5c115911859d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837263, "uuid": "a91b082d-372a-4950-a45c-3c67600d9508", "value": "18D423D19ED186D71A782AF0F9FDA605567312B906DF43B72420B739203CFAB56809F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837263, "uuid": "a75e239a-20e7-4550-83e4-0b639e436270", "value": "12288:vzGWWq8ejf8pCB1L2KbAo991Qsff2SIWM7ChP1O7FZlQ+arWaCtZXhc+d:vj8Anx1Q4IWM2hP1O7rNDNvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837263, "uuid": "5d510e38-4e4c-4b3b-9aab-e16678a16f70", "value": 653872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837263, "uuid": "cf904653-2092-48a1-862c-f9e0f63d71d5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837263, "uuid": "e8015793-fff3-4af7-ae13-216d257cde21", "value": "Purchase_Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1915a428-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868566, "uuid": "12e05e84-5e7a-497f-8387-176e163ef86e", "comment": "Malware payload (Dridex)", "value": "98b66ca94e9d3a518915a7f91fbc3189", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868566, "uuid": "3912d29a-4504-4691-9060-e28e1a8dc8bb", "comment": "Malware payload (Dridex)", "value": "6efa9088035dae3e2af0646e565b31077077001451c53d4b71a5a4ceb01d4b20", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868566, "uuid": "1b32f5e5-0668-4e76-92a0-8d96fab25ebf", "comment": "Malware payload (Dridex)", "value": "e89a2c7f4e5d1e53a06da215f077bd6da6437bea", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868566, "uuid": "15ae34d1-9a81-431d-9b38-1eb08b2daf76", "comment": "Malware payload (Dridex)", "value": "7304bf55f9de144f5aff27494aa8eef82edf1a4f6ac8d8e549010e39c72c369e8e6d42cc16b62e8316326230d8794c78", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868566, "uuid": "16fbd87e-7990-45f7-94a8-3e5f96f0a299", "value": "69F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868566, "uuid": "2b6f2e5c-011d-4951-8ea1-1160db65fdd6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868566, "uuid": "6790fd63-57d8-4a04-a848-e9d791ccbb41", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868566, "uuid": "c910c580-67e6-46df-9a14-c4899890b955", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868566, "uuid": "2343d037-026f-4d6a-8b14-19dd50a7251a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868566, "uuid": "be009c3d-fd8b-4cdc-802d-c463d1c1d42b", "value": "98b66ca9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f2b620-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886577, "uuid": "32da24aa-ac7c-42b0-8fb2-39a0e9ae0690", "comment": "Malware payload (Dridex)", "value": "7aaf49149d5938596c8835525fd97efa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886577, "uuid": "66119fd9-f59a-4f33-8475-4c83f5a478d2", "comment": "Malware payload (Dridex)", "value": "6f2125b0a76363f3e730781eebf39daa3bfa6e78d7afc79946209abcef358090", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886577, "uuid": "0447a9ec-d9f2-43a0-9214-120abab59785", "comment": "Malware payload (Dridex)", "value": "610e2fb50b5f3e8bc6ea9b6ad7399d871f084af0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886577, "uuid": "aeab5d1a-2901-45c0-b437-854ec6326da5", "comment": "Malware payload (Dridex)", "value": "9b3dea2682dbb79498029043a20f19347f0c238f66efc13e6d4eb325c82ccb9b8ca774cbcc7fd19e91da7ba310d348ff", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886577, "uuid": "d0473cda-4a1b-4a88-94da-245cb7c1ad4c", "value": "B0F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886577, "uuid": "c3c8ba09-5992-4e7a-be8d-0a0a3bf92c08", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886577, "uuid": "d8658687-4119-45aa-9f22-e2649edaaac6", "value": "3072:3mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:WLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886577, "uuid": "204e47e0-6ef7-425e-849d-6f2ca7a5eafd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886577, "uuid": "e997acc4-a764-4c52-993b-cf6ac14ff18b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886577, "uuid": "8516de49-ec9b-4abf-8320-b9d41732c3a8", "value": "7aaf4914_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21adfef4-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814463, "uuid": "8867c563-f14d-46ff-9bbe-adf3068ac9a8", "comment": "Malware payload (Dridex)", "value": "2d9ef2dac8862b69b27fea8a63f08e55", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814463, "uuid": "5e7f3708-0614-4a58-90ae-9e88da98de54", "comment": "Malware payload (Dridex)", "value": "6f3af7d516ec2dada09ea91406beac0c996789f8788dbcb0c64c21077dff5836", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814463, "uuid": "4d105277-178d-4048-8fc3-46a528260f98", "comment": "Malware payload (Dridex)", "value": "15e60461ca89fa85cfbcc965d36b235eb3742ef9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814463, "uuid": "522cb829-9ecc-4cfd-accc-7410a6ee5143", "comment": "Malware payload (Dridex)", "value": "439f1641c976d6ed71da4bf985c0a55b28d6103b1390361149be3402e7e1b7c42afc421c120586d9708d3bd5bf5b6b89", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814463, "uuid": "bdc2273a-6753-4a37-a514-4a021b063fd9", "value": "0004B032C6569C82F84D263031ACF39A7A32AD77526ECA77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814463, "uuid": "f00f9a87-f7d0-4d3c-b74a-f59bac3610e2", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814463, "uuid": "2f349ff8-b2e5-49de-afa5-3f7268f6cc89", "value": "3072:VWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:VWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814463, "uuid": "9abc5aee-8cdb-49f6-8f7e-6116a3bafffc", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814463, "uuid": "f86e8331-6df7-47e8-a62e-4848c53b468c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814463, "uuid": "6e585755-473e-486a-b559-e93579c014e3", "value": "2d9ef2da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdb8e5d-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864953, "uuid": "b18f5953-ebc8-432b-bdb5-c3cb0b5a05e4", "comment": "Malware payload (Dridex)", "value": "7f1a6009e921389963dbc62cd8a3b33c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864953, "uuid": "08f6d875-3622-4e3b-8560-06e8de772f35", "comment": "Malware payload (Dridex)", "value": "6f46062f9af3639c13027f2f79db0a0f610a0b95525aaac123d35e36349ce878", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864953, "uuid": "496e8ad0-b08a-4689-b8a0-4259b570ecb6", "comment": "Malware payload (Dridex)", "value": "74e9e1efba8dade50c5c7c8c35ad33a4c2998a05", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864953, "uuid": "5cb16a5d-d04e-4847-ae18-e7703284269d", "comment": "Malware payload (Dridex)", "value": "417617446a0329c5720314c942fee92bed5713b34f56bf54edd09c51f75983f08d37740efdfc8ff25ed7b2a74e85e2f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864953, "uuid": "9abecb1e-6ea4-41c2-b331-22a6b31f267b", "value": "3DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864953, "uuid": "bac8f9c9-6da0-48b7-9ff6-f1267bead802", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864953, "uuid": "8013ec1e-0e97-43d8-9c5a-3b9db4ea8ef8", "value": "3072:glpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:glo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864953, "uuid": "9df04bf5-d210-4aab-b295-a5170ec0faed", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864953, "uuid": "cb3c6425-f07f-49d7-9d9e-f49730b790a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864953, "uuid": "d46f9027-3013-4472-9129-188263d4467e", "value": "7f1a6009_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c574d1cf-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870573, "uuid": "034a0b2d-3652-4d5b-8545-30d3c154e80e", "comment": "Malware payload", "value": "f7177b2cafc4852a6922eec54f7830a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870573, "uuid": "b2f259dd-24dd-42f6-bab6-599bb3d66d94", "comment": "Malware payload", "value": "6f5b310b86976afd56ef5f5aea54984e5d3f2f21f8f0af17f6e4d29d1167a892", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870573, "uuid": "61f210f2-9156-494f-a795-4403cd0e4ee8", "comment": "Malware payload", "value": "583823002c66217ef3be7873e296b3445b613d72", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870573, "uuid": "728ab54a-9383-4b6e-a3c2-aebff62133c6", "comment": "Malware payload", "value": "4a066879a0f83c92f4c5bee5f6fabad69450aa7fec696940484210193c72955245c6f9dd4617194c7e4e8be53f3a8022", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870573, "uuid": "a36dac16-40e3-4492-90b9-32f59ee7c5e4", "value": "DAE17D0F6CCFECC1E626AC71152F5A0F13A63F33365941689DD594828E00BD1E1B67B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870573, "uuid": "9f41465d-dc3a-4cc7-811d-a2fa699d0882", "value": "192:KA3s9qDCmftcqR6yo961uT9UCdsJXhKfiPPON:tEqjftHR6yo96wfiXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870573, "uuid": "a1a4aca2-4ce3-4109-acd0-20bd1fcb5419", "value": 7113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870573, "uuid": "f0b03201-b95c-43bf-aef1-3f18aa9d50dd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870573, "uuid": "9d91fc46-b2df-410f-b46e-0607c6c1c903", "value": "NF-e 5602952-vm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa0f7dc-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868523, "uuid": "e5178b31-ee5c-48f6-bf6d-fc9a9da29597", "comment": "Malware payload (Dridex)", "value": "8ebfe927b40d227fd604fe9854cbf8df", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868523, "uuid": "2479740d-9cdd-485d-ae34-1f906d57b40d", "comment": "Malware payload (Dridex)", "value": "6f70b5654061e84cea775c0effcf0dee4fff6770531ad37328721e8efaeeba42", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868523, "uuid": "1b0ca255-f883-406b-8412-ae3b6ad59baa", "comment": "Malware payload (Dridex)", "value": "eb435da491bc34f288e0ea619bc99d4d89ad5451", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868523, "uuid": "f5d460ac-b071-47f6-b217-219d8f826d5b", "comment": "Malware payload (Dridex)", "value": "0eda8569e5cfa958e3d23906e9542540db471122573742f858163de65913902fc21453db04b55bcb3a30189fceeaeeba", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868523, "uuid": "404b1233-6757-4805-8bba-b49452252179", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868523, "uuid": "2a553800-1045-4291-ae69-5b201ba2bf77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868523, "uuid": "3ea379ee-2944-4ece-9fd0-0428f30934c3", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868523, "uuid": "7d2dce64-7d6c-4e39-b272-701fb1add8af", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868523, "uuid": "1227eea9-db22-4cf9-9b13-cafcc2bc8e46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868523, "uuid": "a3a1c58f-37f8-4d48-b68a-4a0c76852740", "value": "8ebfe927_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310621ad-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832528, "uuid": "a8b1d5b3-6240-4a78-9bf3-8b47dc1040ef", "comment": "Malware payload (Dridex)", "value": "0e18d829106c646710983d338569afd8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832528, "uuid": "aabeff5b-e8da-451a-a61d-431b3c44592d", "comment": "Malware payload (Dridex)", "value": "6f98918595facab838b5b53df4ee1a098a955940c3b8907ad444f072fab37f57", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832528, "uuid": "4cdac3ec-e6a8-4ff8-9f55-c69301e755eb", "comment": "Malware payload (Dridex)", "value": "7a000ab4e8ae5151b719c85f9627a088cfccc4d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832528, "uuid": "a5319d09-e844-4c40-8267-43c2073729d7", "comment": "Malware payload (Dridex)", "value": "446eb2345b8be1e7072636f468c6607fa0e458ff9fa0bec0e391ce473d3f65704811e8bf9da66970ae02dfe604dc141a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832528, "uuid": "f784f51a-5330-4e4f-a4ef-61e46493fe5b", "value": "8DF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832528, "uuid": "1d6bbb69-7c10-45f2-a143-67fbdd32f41a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832528, "uuid": "2addab03-6ddb-434d-987c-066350429e73", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832528, "uuid": "bfb14563-9e4e-46c4-9898-5b6502971e3a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832528, "uuid": "9ef4a120-8bcd-4364-b361-380d65843b74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832528, "uuid": "0d351098-4700-46d2-aa68-a356946bfd94", "value": "0e18d829_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "800c8b4d-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836097, "uuid": "f037f13b-2054-4f53-abad-25ea11d488e6", "comment": "Malware payload (Dridex)", "value": "a2463c0328ad41994630cdeef9269cad", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836097, "uuid": "7ca23a16-7916-4bc6-a813-9bd8dcd33a43", "comment": "Malware payload (Dridex)", "value": "6ff0fe7c5bd29cf25645325f1af98a53bd8cc9193a63ad7de1be58c1042b1122", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836097, "uuid": "a6ec7c9b-be30-48d1-90e8-9aed1edafab0", "comment": "Malware payload (Dridex)", "value": "85a2d59c5ffcb0a6c6f983db2e7608110d181ee8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836097, "uuid": "5675255e-f109-4753-bfa1-69ed7987731c", "comment": "Malware payload (Dridex)", "value": "38b01e2cfcd4db10798003b52afd0176d62fd92a075f6da797fbec033747fd7b57d7a1cacf4d3c9a6b2f1e90ea9d1087", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836097, "uuid": "cbdf1221-ee96-4ef3-bb6f-a213ee51708a", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836097, "uuid": "ae5a877a-d7d8-4d01-9903-e3c6b85a463c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836097, "uuid": "22616b02-7c05-4663-bd95-46654c0e2e0c", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836097, "uuid": "ee107e10-cbce-48b1-bb08-2d31fe2da2b0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836097, "uuid": "1a365bf3-8bab-4b24-be6f-7713fe7dbbe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836097, "uuid": "cde5c0fc-a85c-4ff9-8a77-995ac65d1b0d", "value": "a2463c03_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292140c5-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850554, "uuid": "cb4b5d58-e961-4cf3-8edb-394d2dcd8c60", "comment": "Malware payload (Dridex)", "value": "72d14c9c82b0647a720667fb6feb69c9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850554, "uuid": "0e0c787a-b438-4f67-b4cd-a7ad784b6c3d", "comment": "Malware payload (Dridex)", "value": "701a5ca5745201b2bbee45985b966a70f757cf87b9f8cef1b80fff5496edba9c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850554, "uuid": "6c0cffcb-5ad9-43c6-95fb-d95e5943e5b7", "comment": "Malware payload (Dridex)", "value": "24f388687d7c758dce47c60a52ea5a0b2bd7233d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850554, "uuid": "186bc5a2-7e6e-45a3-8baf-e938f0f513e8", "comment": "Malware payload (Dridex)", "value": "f73e5cfe141d6f06c40ea16e59e42f23df82b6a6d1b3fb873786c1d72eb88bb4933238bd5332e41653c265612452497e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850554, "uuid": "c45d6eaf-fab8-4b0a-8fda-ecb7b44ba6fb", "value": "9DF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850554, "uuid": "891391b9-d3b0-4112-9f03-001285b316d3", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850554, "uuid": "3b095538-c91d-470a-b67a-452f3710e94c", "value": "3072:/lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:/lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850554, "uuid": "864fdd0e-5757-4ad8-afe2-2315da39fb2b", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850554, "uuid": "0e4d55a2-3e45-4325-8034-04b11e800595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850554, "uuid": "d5f5159a-c77e-4469-8199-3443ff28053e", "value": "72d14c9c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9746c348-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621836136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836136, "uuid": "66c34dde-bfa3-476c-aa24-f1f0d8f897bd", "comment": "Malware payload", "value": "751798eb2b9f14d827c94d49e2764098", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836136, "uuid": "09d2a6dc-c576-4514-8339-a07a9586b627", "comment": "Malware payload", "value": "703cb19c4f58a9043fc687cc2a851640d6f79ff7e8afafdc41dfcb3c896df017", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836136, "uuid": "34b895a8-401d-424a-9368-370cfe1f88ab", "comment": "Malware payload", "value": "e7f758090c7af782e5b6e64d2db16fd88f41e933", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836136, "uuid": "d0d979e6-8f53-4e3d-bc79-4431b38d025f", "comment": "Malware payload", "value": "863bbc3f6457d4b5917e5b8d50fd5cc530e3425920748a3e5f30b3481a1510275d375b43eb35d4894c39cfe926f2045c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836136, "uuid": "0318ba70-a919-422a-87c8-ce6b95d5e4c2", "value": "646533E6766C4814C2F40AB007F99FCB70FA7A595932E686B7868CCFB665503C1242FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836136, "uuid": "ff398ae0-d9ff-46cc-8c5e-2f78bcb5ba2b", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836136, "uuid": "3cc34dbe-f500-4699-a4ba-2169ad97c029", "value": "24576:XDV1ZYKY6mufsH4zc+krMPQItIcSqrkE7YSQzzSKskiqXp7Xs9ZX6+:TV1ZYnuf64z8rhrc6E7PQzzlsk9Z5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836136, "uuid": "6f833343-0a3b-47f3-b4a5-db954cda3c83", "value": 1535442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836136, "uuid": "5c64db36-13e2-47d3-911c-79ebd7b8d1ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836136, "uuid": "32e9f89d-7449-434e-895d-0d0d86ae852b", "value": "751798eb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68afd5b5-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621871276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871276, "uuid": "760a0a59-9c88-44cb-9cac-a39b397508cc", "comment": "Malware payload (RedLineStealer)", "value": "7b045591eb7bd3120e8abb6085b4961e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871276, "uuid": "3cb45c66-e5e7-4853-8304-2d337c4477a5", "comment": "Malware payload (RedLineStealer)", "value": "70c093150fa3fde11e3929a1f232ab3a9183efc85bc324e47806eb228cd1c891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871276, "uuid": "a516d9e5-f3b1-4417-9485-ffe399c881b4", "comment": "Malware payload (RedLineStealer)", "value": "ab98697709525e0a5a2161fb0ac59e70b39ad489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871276, "uuid": "64db92c4-f69a-4e83-8c4d-ab4ce198a7c9", "comment": "Malware payload (RedLineStealer)", "value": "d95e2446ad2e6d7ca43bae6964d4a96dc542256a09befd9e5e0f4a46b7664326dca830c724d7a568a3e293931cc98ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871276, "uuid": "9fcc7381-f7a5-405a-be79-d3e64bd2bb12", "value": "C025389D11AAA01BC118C2B899C5AA67E450DF373631AA15FCC3BF8D6B31FD074521BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871276, "uuid": "9df3be8e-7dca-4076-9893-85c59718a936", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871276, "uuid": "d316f34a-9f6a-4ba5-956e-caffd6b1d00f", "value": "12288:GJqyBUUcwYVmbrfkgI43bANcGhUWsjTGvPXqECm4nRVixe98TD4MseMrek8xUyqN:GWUcwYVycCMNcGhUWsGv/abweGfr4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871276, "uuid": "8cb06141-0ac0-49c7-9ba4-5cbced1412b2", "value": 1025536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871276, "uuid": "36d9bb26-ac27-4697-865b-0e4e14f04e00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871276, "uuid": "654b735b-4204-4380-9c49-fab8b9ac0536", "value": "QUOTE_GMC88920018892PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4e9599-bc56-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621836391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836391, "uuid": "832d9558-6148-4f06-8118-9c61473e0013", "comment": "Malware payload (RemcosRAT)", "value": "c00d3017f1d0875d83e6900dea7ec38f", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836391, "uuid": "6cdee0c0-4b05-46c3-a075-c73a0e8587db", "comment": "Malware payload (RemcosRAT)", "value": "711881519140b39140030bcb3904064ca9933b1230cbc6ac95ba77a87c58c986", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836391, "uuid": "95a02ed2-af6a-47dc-a800-1fe509bde242", "comment": "Malware payload (RemcosRAT)", "value": "ad9e92937c1add71c0f6982b8ce737b99eb7ecad", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836391, "uuid": "c0c8425c-efbd-43b4-b485-df9095087c99", "comment": "Malware payload (RemcosRAT)", "value": "8b42d9e933c16cca46720938739046598babff5da3f7779bfa8ae52a96645de1891abf2ce18bc1926724c0b5fb5bc064", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836391, "uuid": "121f21da-ff9b-468a-a99b-16553c53aba3", "value": "71931295EE607C0D20C7153BDB707A05A6B6C89665BC32C5E99786BEE0402CB6D3CAF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836391, "uuid": "73a782e7-2e04-4718-b999-e7e4466301a5", "value": "1536:3KEJcmO8lxjdJrOoQdGYW/trXbNq+BT8ix6CCHqH3RfkpApO/3:dljd1LQoYWVVq+5/qKH39RO/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836391, "uuid": "cf954758-c151-4709-a625-22b5bd6bbc02", "value": 96726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836391, "uuid": "9e14258e-b694-4f8e-afa7-af60000c8d48", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836391, "uuid": "d2ab5d49-7021-4796-b669-e0be28be6757", "value": "Shipping Documents-BL#SE20100078001.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b977e6ef-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846930, "uuid": "81246090-264d-4eb5-bcdb-e8ca73ec4efa", "comment": "Malware payload (Dridex)", "value": "f801dbdd5bbddeccd5064c06cf276a4f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846930, "uuid": "6e5e3e04-dee0-43d0-8945-252cbfd053c3", "comment": "Malware payload (Dridex)", "value": "71330e9d43b5749368a0e4ec4e853718bf95ec496af147fb316f65663a6b1181", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846930, "uuid": "88d22184-13e1-49f1-90d7-9b7b5d175bd6", "comment": "Malware payload (Dridex)", "value": "aeadaacec7f264f314402fdef1ad826d210d4ba1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846930, "uuid": "1d735544-ba1b-4639-93e5-a1f52641f5ae", "comment": "Malware payload (Dridex)", "value": "0ac3e1611144c9bcd07a2a45fe09f45ea962d3d62d5b5dba9e3a038fefbbf06abfce59920fca6fd6674f7c58f6e1c849", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846930, "uuid": "8af6a28a-a376-41cb-a912-b9d72797ed34", "value": "9BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846930, "uuid": "5c8b4590-e55e-470d-bc0e-36989d7c9123", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846930, "uuid": "f1f60ddd-7cc0-48c5-aa1f-25a6411deca3", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846930, "uuid": "41221f41-7d10-4213-97d4-462a9c1ceab5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846930, "uuid": "09974bc7-5af8-4a0c-91f9-5f38e52675c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846930, "uuid": "05108630-910b-47f2-8158-dc7fe4f4eb9b", "value": "f801dbdd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27031b4e-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832511, "uuid": "7d0180c0-217c-4bf4-9915-6769afa34ae5", "comment": "Malware payload (Dridex)", "value": "e1f25f8522bfe1ac8d6fbd8f1afbb9ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832511, "uuid": "723821ee-33e4-466d-8401-b290974dd16b", "comment": "Malware payload (Dridex)", "value": "714cbf294383af5c0345c5cd049a037b26a6b731367c306b583d04163d0ac79f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832511, "uuid": "5aedc3cd-e9d3-46d2-bb2c-55c897bf84f2", "comment": "Malware payload (Dridex)", "value": "cc0ac1f859a002512bbc9f0b5d20a98ced54b1ed", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832511, "uuid": "d56c720f-57b9-4ccc-a3a3-1ca308a0c974", "comment": "Malware payload (Dridex)", "value": "fe470d3c905f5004afeeeb7080037c68dd39d70080a87e2c71d29e1d65263e41fe62dd83253bd7b263af0495b4279212", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832511, "uuid": "f79a711e-ad1c-4eea-840c-512e0d56024a", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832511, "uuid": "940c7534-6cc9-4949-b37e-26eb45785e10", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832511, "uuid": "17beb5cd-c88b-483d-b561-a109de2052cf", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832511, "uuid": "dbf7a3be-9b82-4c15-bfd9-5e4a7adedbb6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832511, "uuid": "17c22912-638f-487f-8bc5-e4a6b5fd5a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832511, "uuid": "2d714c64-ec3d-4d71-8d44-df40cf768791", "value": "e1f25f85_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b4374d-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821716, "uuid": "df459ba6-f6af-46dd-85be-f79054d899f6", "comment": "Malware payload (Dridex)", "value": "92fdbc8c653d3bdf0179207bcb37fe39", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821716, "uuid": "b6d3524a-0d2f-4cd8-b022-7157f6470be9", "comment": "Malware payload (Dridex)", "value": "718c1b7a9b4ca443cc85acda2eb7a8ddf66578b24ab6923622c38e330b85bb12", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821716, "uuid": "a03c937c-3481-44b7-a0f9-e7b6a52c1427", "comment": "Malware payload (Dridex)", "value": "ddd15344ad92062879d5d463941e7d4d7e39f662", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821716, "uuid": "7b6952a3-3a06-4475-87b5-5e646cf3bff4", "comment": "Malware payload (Dridex)", "value": "6ecca38be87a2f3435b38b222eda6150403c44bca5c0030257090005f49fd433a531d234c4eeacee67ccd015c99b5553", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821716, "uuid": "2c8a85f4-bc84-43a5-8ad0-f0d00b2ce289", "value": "68F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821716, "uuid": "7af4fdf9-3906-4c35-bfe1-2710b2db4d2d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821716, "uuid": "7cd84b4c-6190-4e97-a0bf-64c9747da762", "value": "3072:plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821716, "uuid": "87d7de83-a489-4ab2-af2e-ce64fec276b7", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821716, "uuid": "82a898ef-1e42-46aa-adc7-259842efdea1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821716, "uuid": "69c591f0-23d3-4308-a852-5692a29be112", "value": "92fdbc8c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a97c1e-bc7c-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621852853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852853, "uuid": "5c19571f-26bd-46ae-8abb-ee84376fb272", "comment": "Malware payload (Loki)", "value": "793d250011fa5f02a856dfef89253e0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852853, "uuid": "4633b65d-4d5a-482f-a14c-fa641f391244", "comment": "Malware payload (Loki)", "value": "7210f323c7be9520d9b2a6ff0ccbdedcb682216000ed5e7c5e461780579399ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852853, "uuid": "273ed455-c0ac-435c-822b-0217e3790629", "comment": "Malware payload (Loki)", "value": "e8163557daa271de40b617b934b3866b3d0db82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852853, "uuid": "674b0a42-6c86-4678-866a-99d5bfd33d83", "comment": "Malware payload (Loki)", "value": "def22f8c79905de5d0914e74c345081f19ef78d6ee6b992602aba35741ce2603c6dfbae1d297b9ff257d28c76628f8a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852853, "uuid": "7e24de4f-15b2-4f3f-be84-860e29fbdec6", "value": "45648D30A6A0C035F4BB16F449B5C2B8B53A7DA16B3680EB32D53BED45346E49D3079B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852853, "uuid": "50fc4c25-2b08-4337-af71-b151b813f40d", "value": "2c43fac1d0306640e95fe6ef1ec8f89b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852853, "uuid": "94da0f56-a122-432b-a671-af8836e6e74d", "value": "6144:Pm/bqwbJWnBtbkQClRI9Ecj9pVnENDH+XbS2FYkpv:Pm/bqwbJWHHCl2d9pVnENO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621852853, "uuid": "7802d2ca-e5bc-4733-a969-f082a674c0e5", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621852853, "uuid": "c5b4ea76-c253-4e6a-be9f-4d082ddbe54a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852853, "uuid": "b2aa9c57-e78c-484c-afcd-8da9ae91da2b", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d3c656-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879412, "uuid": "7baa391d-3409-4ef0-9b0b-cc27270c7473", "comment": "Malware payload (Dridex)", "value": "e3210315349d9ac836700697aeeefeec", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879412, "uuid": "b7719244-f339-45d8-8f76-cff75df9421a", "comment": "Malware payload (Dridex)", "value": "7216612f46f7938fd90cb152fcfeb969d46e40634d8042f9ef699f8196e5997f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879412, "uuid": "a0586063-513e-4f11-b924-156ef3c817f6", "comment": "Malware payload (Dridex)", "value": "bc026a3e00216b89a6a40d64c070652ddfb6c73a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879412, "uuid": "478c5545-580d-4e3d-9330-fad29e692aad", "comment": "Malware payload (Dridex)", "value": "e107b38bacde51ac93b423d7804bc3bb92c41d7a901de2bd8b43acdb780a903b796f6cc2a812a0ede676c7b8c31a7bc2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879412, "uuid": "ce80751c-29e3-405d-b0de-d6cb59d9188a", "value": "E9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879412, "uuid": "a8938133-8460-4844-9775-fe971d52306e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879412, "uuid": "d6c6a92a-a8f1-4f67-b2a0-fd7a0049499b", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879412, "uuid": "47c0fc0c-4375-4f81-83ea-c490ab24d36c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879412, "uuid": "862e3c30-08a0-4150-94c0-bb2c9649be76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879412, "uuid": "7ea8fc7c-e783-446d-9449-487480f88033", "value": "e3210315_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da144bd0-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621872325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872325, "uuid": "0441c7f3-b845-4102-8824-1b741c7d1028", "comment": "Malware payload (SnakeKeylogger)", "value": "0235322579f7b9414788429ed9c80d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872325, "uuid": "a0dee04d-4739-40c9-93fe-fff8e2b3dfa7", "comment": "Malware payload (SnakeKeylogger)", "value": "721add362b4ba6fde5e9ca6947b8152e3b39ab3895555dc5af0fc04c1ad5a093", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872325, "uuid": "a901ee9e-b7ae-4cb0-a5e0-46995ec12383", "comment": "Malware payload (SnakeKeylogger)", "value": "8afe240f5e7b3a0e981139666eae7604230e49c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872325, "uuid": "f1abb0e2-1901-449a-a0ad-6540264cb191", "comment": "Malware payload (SnakeKeylogger)", "value": "db77ca039b809935b3e7957cf5ccdef750023ccb8c7238cea1339900199d63f1ae42f915f5a1d403911769f26c104fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872325, "uuid": "2c753b86-e01a-400d-bf2a-9c5f43d7e5d8", "value": "B6058E2C512EF521C2ACC63A8AC8943BE595DB373032FD25DCE32B5C5769E90799123E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872325, "uuid": "f0ad20cd-e5b9-46e3-97fb-f2dd28e582dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872325, "uuid": "c7078b04-d3e7-4c1a-8a30-65b7e4121acf", "value": "24576:ORbkMycpT/MdyZNVSveqjNrrPiWIo4xH:ORSM48N3qZCDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872325, "uuid": "bd3a7946-6f54-4556-ba57-d811e35fb18d", "value": 870400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872325, "uuid": "18dc02f6-f720-42c4-add2-2beaadb451b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872325, "uuid": "a8f63990-35f8-42f1-bec1-da98674fa555", "value": "New Proforma Invoice#55920387_________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274f5c23-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872884, "uuid": "f787aee4-b3b6-468e-9c18-b661bf6551c4", "comment": "Malware payload (AgentTesla)", "value": "1777aa42f2036c750cdd27716b8faa9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872884, "uuid": "edaf7ce1-6c18-4654-b6fb-2cfd290d86ac", "comment": "Malware payload (AgentTesla)", "value": "723783b2f0898dc51e3139a7845b62bfacd5ffc44d61ab938162892a28ade593", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872884, "uuid": "8671e190-b49f-491e-99c7-0151982cffee", "comment": "Malware payload (AgentTesla)", "value": "9d6021077ac5596b24cd2a3a790c242b3e10635e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872884, "uuid": "45f02d35-1e2b-442f-85b9-f0e01df7a4a8", "comment": "Malware payload (AgentTesla)", "value": "421c3b34b9c1c52af5f8dc4ec301c378182f679265dbbf0ec8be8c65c1d5c61d543470212ce3f1d88833215443d48377", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872884, "uuid": "8c7c85fd-cfec-4da0-ba3b-d931e7bf7d6b", "value": "4205AD2C116EF126C2ADC27986D4843FE990D7373132FE29ECD717981719E81B99227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872884, "uuid": "74551add-a124-478f-929b-d3bb174c13f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872884, "uuid": "b930c17a-3a78-41db-ac14-71597cfd36fc", "value": "12288:vclBCkX+lks4WVG6Bz6C0gM0w4fW4IQdh9ypUXj+7r8SqvMBD:qBCkuaOY6BzV04P+dOh9ypUQrlfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872884, "uuid": "b08dae9f-c94a-4546-bc0d-9ac5cff3c362", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872884, "uuid": "da9e6524-682a-4a0c-be5b-3c5dc9c73302", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872884, "uuid": "14f4b4bd-20d7-417c-8b08-f7a7cdf2f535", "value": "proof of payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45204d62-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872076, "uuid": "cd1176bf-46bd-45e7-bcc7-db72c77e1843", "comment": "Malware payload (Dridex)", "value": "951c226b2dc14f2f9c4e94832a8b98b7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872076, "uuid": "7256ebf3-cc70-4a47-a1fd-33755d7a984b", "comment": "Malware payload (Dridex)", "value": "7269ae1fe020931fd48b850e90e041a1e859132fef8b17049501c31c71d1bed6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872076, "uuid": "91ae5875-7b5a-41e3-a0a2-b43976c5d65a", "comment": "Malware payload (Dridex)", "value": "d46b77906c01bef1946401e4eed78173b91011f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872076, "uuid": "92c133b6-3343-4e16-9f14-5bac95624ae4", "comment": "Malware payload (Dridex)", "value": "ef867f254bafcdd102929770512a4726dd267a00c78d1974f1d0e9bb959499bfbb3b87c1417d87e251fb4e59f85abcc9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872076, "uuid": "c95c9d01-a188-4ac3-8ac0-14d5c7f44f7a", "value": "AEF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872076, "uuid": "c51717e4-bc51-4e4f-af7a-57ffa73693cd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872076, "uuid": "e09cc9c4-f6c5-4d88-bee9-bfd211abefed", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872076, "uuid": "3f3ebcc5-a51b-4e99-b66d-cd1bcfa364d7", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872076, "uuid": "cd3c3917-bb57-43e8-a946-2f56e1acd8f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872076, "uuid": "c87468d0-be6f-48f0-98d3-64a3efadafae", "value": "951c226b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b51106cc-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818147, "uuid": "c50bfef7-0e78-4bfe-83fe-e3b6d11a840b", "comment": "Malware payload (Dridex)", "value": "872bff1a7e9fe833c5dd6fad7bdf2b0f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818147, "uuid": "4d37b752-2313-4d18-9ee2-34c3fa933c31", "comment": "Malware payload (Dridex)", "value": "7349a33059c3787e135d21eaf28bddbd3491ad3cc846f9a1a5d14aba958a9e30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818147, "uuid": "220f3ac6-5fa4-4c89-a8c2-35b6f24dbf88", "comment": "Malware payload (Dridex)", "value": "00a734dae1c99a33c601b2e573a9f8212acc1c10", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818147, "uuid": "2c26c9f8-b24b-4283-bad7-a62e4a4c1754", "comment": "Malware payload (Dridex)", "value": "de18c564b9267a9c89476e19171d2898372ed4500fe8ff4e8311842087b542cb6d20dbb3e41a33820d6b44d4819dd1e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818147, "uuid": "45ae8e24-f646-46fa-8625-73954a7ef65c", "value": "12F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818147, "uuid": "8558eadc-3b5b-45ca-a06b-8181c4cc42aa", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818147, "uuid": "9ce76757-51a0-426a-8bff-b31aed669713", "value": "3072:cmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:FLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818147, "uuid": "31c33a30-a627-4173-a834-4b0f9e3f0101", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818147, "uuid": "e916d49b-1218-41a9-a130-4f2fd8f34908", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818147, "uuid": "aa912dd0-fbdb-4899-9608-b06c62acbc56", "value": "872bff1a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ff9c786-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868550, "uuid": "02fe73ef-dc02-4a9f-8249-22d390b6e5f6", "comment": "Malware payload (Dridex)", "value": "477302e40eacd4c32140fef60fac39f4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868550, "uuid": "3b1f3664-776d-4bb8-bd1b-ed24b148c9de", "comment": "Malware payload (Dridex)", "value": "73dc934a4f46da3cc0f7e23708163c988fd95452d859a5ea54365965e7d457f0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868550, "uuid": "f07831b2-c6cc-4b04-9543-d2cae06b08cc", "comment": "Malware payload (Dridex)", "value": "649e535b97289289d1f42209a16d57d0626748fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868550, "uuid": "b1439517-351a-419f-88d7-2b77bff4c69c", "comment": "Malware payload (Dridex)", "value": "3de3ddbb451f7d48df3db6220a4fc25a23a5fed2a7a0291e9129381adf8964bfc641bcc616eb9bb3ef659d66e45d08c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868550, "uuid": "bb8e7839-c986-4d77-bc13-5fe20841bdff", "value": "EBF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868550, "uuid": "208e3295-05ef-4eef-b73d-f24861c3ef22", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868550, "uuid": "a572d120-da96-4df9-9571-02ece96800f2", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868550, "uuid": "480b7671-57bc-4593-9f4d-e5b13b1d29b9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868550, "uuid": "8389e594-87a9-460a-8866-d71d837675d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868550, "uuid": "2c7face5-abbd-4af5-ab08-90fef14d86a8", "value": "477302e4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d26545e-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868599, "uuid": "bae311b7-8075-4c09-bf0c-a33797c5cee7", "comment": "Malware payload (Dridex)", "value": "8ae03e6942734de74db2df9ec3cec769", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868599, "uuid": "59b2392b-9325-4577-b978-5a908bd79620", "comment": "Malware payload (Dridex)", "value": "73e38bf76c54e52b944926ec4a6eb2816017fe95cc49f58b5da050b5caec13a3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868599, "uuid": "f3ab701c-ed45-407c-98b4-bc7a00db6476", "comment": "Malware payload (Dridex)", "value": "fb01d9c8da7123e37bab16a05493f03c176416af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868599, "uuid": "f5d55691-328f-42f2-b003-5ae76d303d6e", "comment": "Malware payload (Dridex)", "value": "d7c2f0c7e8b1254487ebab2ad01224780020b97a015e05c3bffdf842e7cf5bc41882156b47e7c49e48373c67993c4dfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868599, "uuid": "fb06cb3c-883a-4df0-9d6c-b95b1a200a95", "value": "CFF3D088CBB3E4E6EFB3937966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868599, "uuid": "da320b31-0079-4b47-9e4d-8e9bf5fc43af", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868599, "uuid": "d57141eb-027a-463b-8e26-dba4af1cdead", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868599, "uuid": "a52a0f28-c863-4fae-b01b-8644a0e32aaf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868599, "uuid": "8996a042-8ed9-4261-aff7-c7c95e21134a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868599, "uuid": "f5975544-a076-4c05-8f6a-7f7e8f5fb902", "value": "8ae03e69_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36160f13-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621879352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879352, "uuid": "6e74f4b6-2f3f-4844-b376-4cb591eac157", "comment": "Malware payload (Loki)", "value": "2ebf378c0f5dc85ed4eab9504c8ce52e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879352, "uuid": "bdf1b5d0-825f-4dc4-a5cf-3f596e14f6e7", "comment": "Malware payload (Loki)", "value": "74c3d04a850fd5c3a428d3cefda0212327379eda407c0fa1b7414c5652846e70", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879352, "uuid": "bb4afe23-e198-4d7f-87c6-f2cab9fca668", "comment": "Malware payload (Loki)", "value": "66ca40a6ebd4f08afc4bb0f2f1de43df7680a36f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879352, "uuid": "dc43a212-2fa7-4404-b831-e181e2a6ccdd", "comment": "Malware payload (Loki)", "value": "f32daa10911d631944cc3dad1da4a492e9d72b72ce9f3def705970fa29799020a975ea3409d2c33b62ac7d180427fa5f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879352, "uuid": "150b7e38-1e0b-4391-8e1e-2f80e814bcad", "value": "7BF312EB5A02E722911C66C60DADBA4D887EC61F7963D72FBF54435FE2C030A187A4D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879352, "uuid": "2951e389-43c6-460c-991b-cecd864b5e8d", "value": "3072:5iTxdHsMrXNG+rWow2HZHzrKd5THzZtNzNokllZguIzGn/zIqhaoaWAtbzDsKXOD:5izxXcMhw2HZPC5THNtfok7ZTGG/zIc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879352, "uuid": "27aeff21-7cc0-476b-9e60-d54557b2c8b4", "value": 171159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879352, "uuid": "c1bd9a58-afac-43bb-be16-40d122099fbc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879352, "uuid": "4dc61ab2-dff7-41b0-a600-d42c6cec30c9", "value": "2ebf378c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92833cb5-bc99-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621865333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865333, "uuid": "678d649e-bcad-480c-9355-6373e836c912", "comment": "Malware payload (SnakeKeylogger)", "value": "ac1b3ad668760e5d81af9e202325908f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865333, "uuid": "90a360e6-7fe4-45f2-9c02-5f9dff7c1a4e", "comment": "Malware payload (SnakeKeylogger)", "value": "74f4256a809b0c1aefb2763a74d9add5a021442d2e45185954e152d314a76106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865333, "uuid": "8a1038ea-8e8f-4aee-aef2-e52409fe10b9", "comment": "Malware payload (SnakeKeylogger)", "value": "bd26f0d952d11bf9066b64b5426a1f6965c0c13a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865333, "uuid": "1f1565b4-3c17-4464-868d-41af2210ee25", "comment": "Malware payload (SnakeKeylogger)", "value": "6d222c7d62553f3875f23c1d1dfd36ece23e04867af0ada9f5b566ccd090da3b3c26bc76834b889c27e39f28be58058d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865333, "uuid": "8b047fdc-ed57-45a4-97f1-9f4584908b17", "value": "3425C4EFBD1C719ECDF68831F9E41EA499157C7642078303707F3A99AA2D59E8F500A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865333, "uuid": "1cd15c86-3840-4861-bf24-2930bbc98dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865333, "uuid": "d5f12810-9224-4a7a-b3b5-ba9f7fccc60b", "value": "12288:NzmYPe1B5J49lDJH+8RN1JJgZfL06Sj4xj6pMmnwqpAUl//xZkBXULjrUqteSkdC:Rpmr5JYTH+8z1JifLiKj6SClj+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865333, "uuid": "311e63f6-f59c-44cb-b12e-4f76ef9bc45f", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865333, "uuid": "cc964acf-6f30-40a3-b3f5-697736be11fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865333, "uuid": "8faea5a0-3bd2-4e54-a3e9-b0a0ead49c1a", "value": "WDMFT505_BL_VNHPH01_NTTQUYNH_0520_000018_040BA05287-MAIL.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a54c5e4-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870500, "uuid": "66f6d8c1-138c-4b12-80a7-49c8f8a0f623", "comment": "Malware payload", "value": "d78e1a10fcc4cb0c5b0b1b329449afe4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870500, "uuid": "2e6157c4-06ea-4ee6-bd87-210aa305f353", "comment": "Malware payload", "value": "76132b17808bd484931797e4ffdce6bfc00e58a7f5625b20dba0610a50d19328", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870500, "uuid": "b0cdf74a-aeab-4be6-9812-290a9d6467fd", "comment": "Malware payload", "value": "7b200bdcfacaaf4e19a57eb2563b603a085b82c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870500, "uuid": "00ec0c7c-ebba-43a8-8882-e967d7236468", "comment": "Malware payload", "value": "ab27ac69f1f2636468956269177f3532a60b699ab40db3b7e512a0d17a5d69e59cd84a4e84fc04afd15a6b8ffc11cd8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870500, "uuid": "8d6e682e-83aa-46b5-8bf9-31aa68652ecc", "value": "8BC0125E4E056543A64D12CEE56AC587C6C589F472B5A0666501D2A666258400C254E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870500, "uuid": "b5c913ce-709e-4ffc-ae4e-a660fc91e55b", "value": "3:3oNbtdovT+4GCGniF3o89iVHHn7GV5HMhfqS6QMPpGCWM2HCu2S50VRYKBIrbM:YNgZsn4gHH7GV5H+pYGVPCu150FobM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870500, "uuid": "f9abdb00-dccd-4ac4-86d6-084338b6824f", "value": 185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870500, "uuid": "14ff5dab-83dd-435f-bcb7-1a7b500db878", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870500, "uuid": "4f09c73a-d127-45a3-8d30-46ee97d097f6", "value": "Order-ID199247213877734.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a186e9bb-bc9a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621865788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865788, "uuid": "8365ef44-c767-4db7-979a-63094fedb36f", "comment": "Malware payload (SnakeKeylogger)", "value": "c31404ab6bdf8b90dea181560c1c90b5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865788, "uuid": "51988761-9d28-4575-97e7-723ddc3c482f", "comment": "Malware payload (SnakeKeylogger)", "value": "76489e8adf7e046f7cc7513ffc79760e313ad3e71ccc63e361173a410f5d1444", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865788, "uuid": "449453cf-777e-467d-970d-4bfcd1680845", "comment": "Malware payload (SnakeKeylogger)", "value": "8ca199b49bd90cbedf9c411576c4d2279905de86", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865788, "uuid": "57cbd37c-92d5-432b-bade-9f64b40a83f0", "comment": "Malware payload (SnakeKeylogger)", "value": "3f2f39ae8a7d18069010790c366533ac19c8685235d6bbf0962aa466daeb81ca9f43fc3e83420bd7f67590910a34c9e6", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865788, "uuid": "36606b30-0440-4006-b4db-deaf02e8ed40", "value": "A5A4238ECB7504CC5EA4DA47D8A9FDE71E8690B9E51437E3B713F58239F3A148025C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865788, "uuid": "05af83dc-1022-4105-9e73-2eae0717c1ea", "value": "12288:lnrYlKC08zE/Vq1YsHTu1V+crOUzRDRflk5P5MbQCZaGr1TFWfUK4gbE:lr3Cd4/V8nHSkzUz/Y5G7nr1sMiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865788, "uuid": "ecf744a7-597d-4642-b65b-cfa994a2a0ab", "value": 471878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865788, "uuid": "b3123eec-81fe-47f2-9fff-3c2e18d9201b", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865788, "uuid": "4b01d32c-9aeb-475f-af2f-894e7aca03f8", "value": "Scan 130,839USD.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78532cf3-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872161, "uuid": "b072fca4-31fa-4763-a17c-1b3c1399732f", "comment": "Malware payload (Dridex)", "value": "bd2083772cee65aca3331ff0f1bc7bb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872161, "uuid": "bca9a2c0-7ef8-4cbd-9c2f-eeb1ef21f975", "comment": "Malware payload (Dridex)", "value": "76a4f6247ac281ac593288bb9e2f724fd4c557ebda673db1dd3a51aa49188e7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872161, "uuid": "4be045f5-e9cb-4554-aaf9-14ee83369b33", "comment": "Malware payload (Dridex)", "value": "2991e8d00d07044b850c50ee5bd939b15ff49523", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872161, "uuid": "c5901a68-a25f-4d7f-b1a9-8cad4bd292b9", "comment": "Malware payload (Dridex)", "value": "30f2852b367bd9bb90377745c3979b3d8310add86cb2d29990d5428e8b127a69bfff298869633d44b85efd65c6d6510c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872161, "uuid": "4452497a-c11f-4402-994d-eb7a3c4d6f9c", "value": "81F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872161, "uuid": "3f8e07c3-0a39-4514-989e-293c7d77e383", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872161, "uuid": "7fdb5109-e253-44f8-8374-f17dac8d4093", "value": "3072:jmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:SLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872161, "uuid": "c4b416e9-71fd-450e-891b-2edb7cc6f979", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872161, "uuid": "182fa054-dc33-41c4-b29e-486946175ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872161, "uuid": "4a14d06c-3cc0-4786-98cb-ba9d22fb6e3c", "value": "bd208377_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f06c120-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893701, "uuid": "fcc081b0-2826-4c62-9d99-4d04afdc4c67", "comment": "Malware payload", "value": "2d6a6f391c1970ab211a131bb5920cc0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893701, "uuid": "1056c748-ef75-43d2-9143-ae62ee7a78ef", "comment": "Malware payload", "value": "76aaabfe4dae14f48a64a4750761ead045de1479feb7e2e800c0655de5b019ec", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893701, "uuid": "6f6e90d4-a971-463e-92be-0871eaaa5437", "comment": "Malware payload", "value": "a9bd65fd7778e3d0386b2848b8e2508b59fcb408", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893701, "uuid": "50913071-55cf-49b2-80da-6a3748688c44", "comment": "Malware payload", "value": "793c73dada82d8332da653311b134d08092ad7140b346a5a9d9ee0a439057fc3ab7900654deb0cd974985d93d7487c0a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893701, "uuid": "673de862-ecfc-461a-b6ac-016913a72b94", "value": "FAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893701, "uuid": "b65f9db2-4038-42dd-81ae-2c961bee3c0d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893701, "uuid": "2e71d1fc-58cd-4f5a-8259-8c1eea0ccbc9", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893701, "uuid": "d5d3f52c-5be2-4642-a122-639382b4506f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893701, "uuid": "ac1e30ef-c310-447a-889e-66b2236803ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893701, "uuid": "ecde0abf-9fbc-4bdd-b714-8393a644977f", "value": "2d6a6f39_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e171bea0-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621854299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854299, "uuid": "f37283b7-9a89-47ba-ba74-0dc9f48161b6", "comment": "Malware payload", "value": "1fc7d0d2b325dd51c6e03baed5da9cd1", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854299, "uuid": "ff5c217e-b18b-469e-a812-6bace86f24c8", "comment": "Malware payload", "value": "76cbf3e6699f1f84138d619518379114f139e67d96446572dc36c6637cea39ab", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854299, "uuid": "5c29a86c-2c74-45d8-b579-8a8e7aac4abd", "comment": "Malware payload", "value": "8e1f0a4bd2025218848408b1930b7472ba0cd1cf", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854299, "uuid": "d2aca1b3-3d01-43d8-ac8d-1e80f453a003", "comment": "Malware payload", "value": "4cd0a89a1cffede917411a3e9ab0507cd64c064480dff40464fa184daff092d077a589e30b25a0eb99206b171a62878e", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854299, "uuid": "6fcabdcc-0437-4431-9e01-84c317314fcc", "value": "29329EAAE901F426C34F96BCD0760AF9A64E5240A667845F2085F34CAA402C397CF56E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854299, "uuid": "d3522496-c350-4a70-a560-fce650327214", "value": "192:ScIMmtPQpGu6z5bv/0n61qsTjmJYYobziYLHST2K+2l:SPX1JUOYsziYST2F2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854299, "uuid": "587dffad-8f85-4091-bb99-a45598b7aa69", "value": 11740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854299, "uuid": "c8068be7-7df4-4d48-b25d-5864803378f1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854299, "uuid": "0c03b3df-3d9f-478c-b342-37007d131bef", "value": "From Mark Stevenson 2021.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8919da7b-bc7c-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1621852862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852862, "uuid": "adecb57c-4ec6-489b-ab80-c217eb75f677", "comment": "Malware payload (BitRAT)", "value": "591dd5630dcc4fca0340f442735c2fd2", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852862, "uuid": "1d82c1eb-b2c7-4ceb-99ef-0ebb9d4a721a", "comment": "Malware payload (BitRAT)", "value": "777a8e5ae3342940c8f95e98a46d5b9bde8a431692f91b9b26d265034d6f41a1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852862, "uuid": "08ee8d45-0441-494b-9423-f426ff46f69e", "comment": "Malware payload (BitRAT)", "value": "de60b2095b3c8b85069c9f21ebddee79d0aa3b36", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852862, "uuid": "e7285ca6-cca5-4542-8342-e984a7d21488", "comment": "Malware payload (BitRAT)", "value": "7ca8254b404058d812cfbb3210538a11c6b360a9e07300b089eac321605477f1af623c014e67d59dc2e086360cd50e75", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852862, "uuid": "562d96de-c068-47c4-86fd-e3b2695e5ee7", "value": "B67533F6F2E074A7CC663EF8746A8D6867F5E1004921536F87518B2E6CBE00784761EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852862, "uuid": "1d4d855a-169d-4928-a781-46cbc69a4c1b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852862, "uuid": "9e73241b-645f-433f-a9ee-9872cead6bab", "value": "49152:kjvNYv1h3ApCGe4vMIwvddGpxxuztB2Swh09:SN61uULuOddGpxAIx09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621852862, "uuid": "5377cb04-1f1f-4d96-bebc-d324f8724fe8", "value": 1583203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621852862, "uuid": "0355e7ab-d7af-4fb7-8d37-e11fc0941375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852862, "uuid": "37d62d56-69d2-4782-8146-49a845925eb3", "value": "New file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ddbb37-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621843376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843376, "uuid": "11b686f5-a982-4325-88e3-2985827808a8", "comment": "Malware payload (AgentTesla)", "value": "0b8e201ee4cf329eab00e1347375823c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843376, "uuid": "110fa83b-4557-42a0-ae2e-6b9348365b72", "comment": "Malware payload (AgentTesla)", "value": "77ba3f530e9151875120dd9bd74926ce467d38dad3508e396b3ce7178c7f2e89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843376, "uuid": "3380e726-49d6-417a-8e46-0c3716aaeab8", "comment": "Malware payload (AgentTesla)", "value": "be35e70487bc0c50e6c3bc37e5c3fde0422794b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843376, "uuid": "1bb2ccdc-9c7e-4913-94e3-ee65953af8d1", "comment": "Malware payload (AgentTesla)", "value": "307e106be0746e48fc5f338d5eee670644467c2310c5c6260d63c432b8c0c486d0778d4589f04f83ce9f0c5ca2c6af61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843376, "uuid": "153a3bf8-d70f-432b-8342-8be646b3f042", "value": "DC25696C1059F112C06EC2F94ED18627F25DEF3BA032AD14F9D777881A16E82B95326F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843376, "uuid": "0b0d8f84-1f0b-4f2e-997a-b078d70d9c87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843376, "uuid": "285b3055-eac1-4bd2-9333-74a748b87ea3", "value": "24576:KyBdlK+YpMbP4KNLvX2DbF+E6nzFsZ4lf+:374KNs16zx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843376, "uuid": "92b13f79-9fa2-463c-a6eb-8c7177e6c99e", "value": 1045504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843376, "uuid": "cc13a418-f390-41b8-af30-c7857910ff34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843376, "uuid": "8a646ab1-db4e-4705-8657-1eb426b87a3d", "value": "0b8e201e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1b1a50-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621882880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882880, "uuid": "8fae6e54-4c9d-4a59-8256-49caf64e1dc3", "comment": "Malware payload (TrickBot)", "value": "e42c61b4b6a620f3cbe106210b482fa0", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882880, "uuid": "c65e355e-d1f0-4eee-8773-5e32f52382ff", "comment": "Malware payload (TrickBot)", "value": "77c83543a8b258d3bda52528197f56418d2ae17b2b710c9dbf87aae59e5d0f35", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882880, "uuid": "c8159839-dbb1-43f7-b70e-79bb029a38a4", "comment": "Malware payload (TrickBot)", "value": "00feb1d9535505553a71ddbab3845fdcf0644077", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882880, "uuid": "f9b07fda-4403-417f-abac-adcd3da7c2e5", "comment": "Malware payload (TrickBot)", "value": "97bdca3007e0cad19076c9b64b2a9442a5266fbea1cf7a427fde7b128f1c7990029a6ae1d1e77be4ce33baa2913419f7", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882880, "uuid": "8b106bc4-8895-48cf-84b6-b2590c6865da", "value": "330402EDAA91E525E7A408F3C4405B831C771FC747876C6A7B12628477B09F742C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882880, "uuid": "1d3659cf-5dbb-4c1a-b70e-b0e574756217", "value": "3072:IRevjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHzX:cov8cKSsYodBXC0YnW49MarG19TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882880, "uuid": "def2b406-9895-458b-b80a-97c12b4d4d8f", "value": 187789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882880, "uuid": "6f07feb0-024e-4e9c-8fa8-d0596f16a8f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882880, "uuid": "934bbffd-6990-4cb3-8ef3-8ea5b76e6e27", "value": "e42c61b4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8943e125-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621836112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836112, "uuid": "e96022ae-d1b4-4516-8c78-e419f98d2dfe", "comment": "Malware payload (NanoCore)", "value": "3d66e020961260c95adc47de26f5670f", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836112, "uuid": "f2afcda0-f4c2-49a0-9813-9fe91439a16f", "comment": "Malware payload (NanoCore)", "value": "77d68d6c2d36c771fcaed62a55fb04d4308d78e08881ed90b77e8ad96168ab1a", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836112, "uuid": "4f50ab9e-a423-4aad-902e-22e96a049a18", "comment": "Malware payload (NanoCore)", "value": "4bbb6d1321db3be0db562dbe0e4f76e46fd2f02c", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836112, "uuid": "fe721715-71dc-4677-8613-391fe43816d0", "comment": "Malware payload (NanoCore)", "value": "b5317387a9acd6dad6c94633272ed384c4414e144b98c3e5f5f40bd48b592c3a1c180c02db1ec4e02b090fa76b2fab2c", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836112, "uuid": "18af41ac-c75a-42f3-9cbe-6597ca3c661d", "value": "4CC423B60D693CFEB94413D3817B2EC4317325CBD55D2ADA070A00B37DA6217923CEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836112, "uuid": "2c0943d9-7ece-469a-a8e7-c5e4b7232013", "value": "12288:6eM6xiXUe6np6CueqeEWPcRvUFQuVRKh2/e0hRpKBA1:6J6xxe+6wshIQuVRYd0hR8A1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836112, "uuid": "2db4597f-2e31-4feb-a945-a8fb839c1212", "value": 585374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836112, "uuid": "907fd943-eb13-4766-820d-9217f36ec20f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836112, "uuid": "0815d3bc-d89f-4326-b0a6-4b2691cd1fa1", "value": "SKMBT_C36017022513490.pdf (31K).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630cc054-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621861388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861388, "uuid": "b2e94dc1-4736-428f-b6db-5a072904e46f", "comment": "Malware payload (Formbook)", "value": "b9f9ceb873a7d1b47bf25851f67a91a3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861388, "uuid": "3f1d16e7-b336-42d9-8e4d-962cf1bea602", "comment": "Malware payload (Formbook)", "value": "77f75ced9cfdb9bff40e705aaced15795f123e460db0fcb97463e0515aaf8af1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861388, "uuid": "ff702be8-52a6-4177-9b00-33c77eb0f131", "comment": "Malware payload (Formbook)", "value": "f44a554898b2c3334dd902f160824fe25fed2b17", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861388, "uuid": "dcfecc3b-1cfd-45b6-b917-101e7eff5763", "comment": "Malware payload (Formbook)", "value": "a218c57a8e3d9a5630bc3bc8b3d6fc9bddf9bd5e1a8fb9365dd79be539c733e18a443e521df155c7cd5c2e8216304ef2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861388, "uuid": "268cd4b1-d32b-4cb4-9667-c67e1106ce07", "value": "F82412A830D185BBF6722B721EA3576BD3FA874332B6911F5B000F681868086D50D7DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861388, "uuid": "458ea986-a114-44fd-8293-b94ff3b98bac", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861388, "uuid": "41c776dc-8b11-4bef-a1bd-2423e938c9f9", "value": "3072:gQIURTXJEdMLe8dFlIQV8H+0Wfyh37IMjSf6WFR3tDHfLO5yNIMhk6m155sIsiTT:gsuQdF2QwGM9jFm/Syxk6mpL5Pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861388, "uuid": "03d48385-a575-4715-9c26-3280c0c304a8", "value": 220877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861388, "uuid": "7df4f32a-36b2-406a-b8de-8c6f8ba62eea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861388, "uuid": "02b2c737-c348-4a84-8ecc-aa15fcdb564e", "value": "b9f9ceb8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea5dff2-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882990, "uuid": "9dc3443c-22e0-410c-8d7a-83ffd933c651", "comment": "Malware payload (Dridex)", "value": "6b4e44bf01d4c2d21b492ef515d4b3cc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882990, "uuid": "075a726d-9939-43bf-936e-36fdd891e301", "comment": "Malware payload (Dridex)", "value": "7811237ec9a7aff7ab67875c040a580361bbbf27249bcfce22d84b45ce4f50a7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882990, "uuid": "badf8b0f-06ec-4787-8707-55626b8748d4", "comment": "Malware payload (Dridex)", "value": "752e0658c490ba72c8e786a0741c1327ccc01550", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882990, "uuid": "1e65f6a4-4c3e-4a2e-a9df-e0f33bd4abf0", "comment": "Malware payload (Dridex)", "value": "acfc7dbdf8570d15873f9ea13d9947f65d0abb8dab2716fac2d5c066d2cc89af816350904c83dfce6d65ad1335da2cdb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882990, "uuid": "55ce691d-ef18-4234-9795-6835e041433b", "value": "41F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882990, "uuid": "f882d072-58a2-40d3-8555-733b27d7c0d2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882990, "uuid": "612fd793-50e4-4851-93d4-20240d5c4677", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882990, "uuid": "13c7b235-fff0-4074-9232-2e83ea56bb5f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882990, "uuid": "351dfcf9-94a7-43c8-9dde-08d0325521c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882990, "uuid": "6ce5b604-3809-49b8-8a50-81abdb419b1f", "value": "6b4e44bf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7c173a-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872630, "uuid": "7378422b-7906-42c6-ac62-c874321968cc", "comment": "Malware payload (AgentTesla)", "value": "95797239fa8d82fa61fc8041afb36411", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872630, "uuid": "4ed1be3a-c21c-4a56-9cf5-8cb1d2f068b2", "comment": "Malware payload (AgentTesla)", "value": "78a4a4daa01d5c5456db2c27fdd985885775bd94be0c179ad739fc462630f70b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872630, "uuid": "fa4262a3-4b88-4d81-af45-5a6b8eda17ab", "comment": "Malware payload (AgentTesla)", "value": "5ecb5b69dff30f6d05d961c02c3e1dcede506b3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872630, "uuid": "80a6b145-84ad-47d5-8ae9-9f0b130264a5", "comment": "Malware payload (AgentTesla)", "value": "6ddce2261a33a3c00fc1ec223dc8c821f62f2bb0b0db1adb0edaccc1feea805653681c7247bd19956a9e5647e9a9da50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872630, "uuid": "b78e117d-6b6e-45f4-89b2-d8f4f4ea71d2", "value": "6645052DA206E080F55DD0B1CED0AAF6D402EF3BD6262D1795C73F81713AE563A3A15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872630, "uuid": "00f4b918-603d-45fd-942e-488a5ab4ecd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872630, "uuid": "2517f0e2-ea58-4d16-9567-c77e196238bd", "value": "12288:LW0BCiUaF9nS5AYLve5xOzbkfSusW8sXzk1odwQ9+lor91pwiT5KJ1:pBCihuOx8g6BNcyodw+HwiTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872630, "uuid": "8a6dcb5a-1815-45c6-b98c-937e3047a2d4", "value": 1231872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872630, "uuid": "456e1fc7-4a06-4a6f-a638-93c49f3262d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872630, "uuid": "663d78cf-39d4-476b-a64c-5171d1833bf8", "value": "PI-FD277578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d92d11-bc6a-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621845208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845208, "uuid": "d880412d-c1cf-41c8-8b82-465ac3f40abc", "comment": "Malware payload (SnakeKeylogger)", "value": "a04e0e4e7ce5dc40a13c36c92932085d", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845208, "uuid": "d41617ff-2b3d-4f4e-ae39-3e7dd665c837", "comment": "Malware payload (SnakeKeylogger)", "value": "78e54396bee24a0ea8f6e6a84235e21893b8ecfd5533462dd7b8e98abf7b17a8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845208, "uuid": "3586a5e4-e75a-4a3f-b225-63e1d7790cb6", "comment": "Malware payload (SnakeKeylogger)", "value": "bb6892409c9a2ec624f202d36bfd3a19e9b054d9", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845208, "uuid": "831e7c32-73c0-43ad-b18a-bb8d8190f690", "comment": "Malware payload (SnakeKeylogger)", "value": "f78de59db871411e1339c907c0661d6153f3561f6323df3ce6c726662ac89b5e9c224262e4675a76c3deecd77f62489e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845208, "uuid": "a80d025e-0284-4830-b854-27c4121fe8e4", "value": "A125161E2E99E119E0E8C63D05F90027FF52CB73203AAED698C337AD1695D41F96162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845208, "uuid": "5d8b085c-ec1a-415a-99ca-c8427a8890ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845208, "uuid": "dbddd852-d3f9-4f9b-92e0-8483d249756b", "value": "24576:Agth72fXRnUSN1kWICmkwnfKsJq8PM4J:0RnUSNmW2kK/Jtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621845208, "uuid": "f48d89ff-ceb7-487a-b450-a8fddb63f75f", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621845208, "uuid": "38a5289d-a8d5-466b-ac7e-88a23d88e0df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845208, "uuid": "48f12bb8-61c4-41ee-ae01-b6c6def5b7a3", "value": "BINESION QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02f6322-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872255, "uuid": "f2616103-8ef7-4b53-ad22-57fa94c6a0d7", "comment": "Malware payload (AgentTesla)", "value": "5c8003788c729d9c9d6f91c62aef10f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872255, "uuid": "cccd9e08-c993-4c06-b0ed-0956cfb2b544", "comment": "Malware payload (AgentTesla)", "value": "78fb258de3506eb1a38ee1df88caf29dfa667fe6c2c5870713d95a15ef0bc3ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872255, "uuid": "b9013298-b0c8-4502-a291-d2d6be2269cf", "comment": "Malware payload (AgentTesla)", "value": "08dee284ed7c52dfe338c68d34dae9636baaa84a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872255, "uuid": "2358db67-b782-4fd2-8e0f-fafea77acb84", "comment": "Malware payload (AgentTesla)", "value": "c8a6979b9d9712a194cc35f7a8eddae17e7c15d64b0024f2da1f175681e723065e13bf525ce7d94cc7d12a71134968cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872255, "uuid": "4b55bdcf-3cd8-47c6-b05f-d7ee0594fb7f", "value": "D215D0AD325475DEC43FD679DA681C68EAF07477831BD20BA12700AD9D4CA87EF211B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872255, "uuid": "2288d5d2-102b-4640-96d2-c3a86f091306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872255, "uuid": "82f9a21c-ce9d-4bc2-9382-7772f96c8b4f", "value": "12288:WKzvx3UOEy1k9mHt5++jus28bUwRdF/WTOUaNp6g3fl4eoCs2pAWtDTK53SidOV0:vzZEy1k9qH9l29EdlHf3aYDTK53S+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872255, "uuid": "6ddc598f-73b8-4046-ab1c-1a307ddc286b", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872255, "uuid": "c479d489-55ce-4ed4-93da-3b2104b4ff1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872255, "uuid": "bd873acd-63cd-459b-91d0-eab96812afc5", "value": "5c8003788c729d9c9d6f91c62aef10f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361122fc-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886653, "uuid": "650e43fe-3d36-4637-bc19-ed74f72a00c7", "comment": "Malware payload (Dridex)", "value": "130de76d56bb90436cc54bb6b905070d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886653, "uuid": "b099f872-0002-4974-92b8-0c0a7b082790", "comment": "Malware payload (Dridex)", "value": "7928b6c3e3e329f89cc075558d5a4acd77085c5a53b23cbfe0e26fd3fb4c1b06", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886653, "uuid": "6a34c99c-d797-40e2-8188-34341089fb0f", "comment": "Malware payload (Dridex)", "value": "26e762a45cf332a41186281fa807bc81eb45cbac", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886653, "uuid": "17be0a8b-cb62-44c8-8312-fa25d3a29c99", "comment": "Malware payload (Dridex)", "value": "026a3df2f6d880e6d26e26e56b25ad11e68debbb6a03113dc6dfa77bf7d4ad8d5e4e1284b275f166e94e4dfea5ee7e35", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886653, "uuid": "4119b2f1-80f3-453b-a83c-f16afa49e2f2", "value": "88F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886653, "uuid": "4ee272e9-c78b-43cf-80c2-153d6809911d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886653, "uuid": "a9888f90-37c6-493a-a00c-865b1a9d75a3", "value": "3072:HmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:GLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886653, "uuid": "e1af2d0c-781f-4c2e-a273-7ed9a0c15098", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886653, "uuid": "d9a6a40f-14a7-43ba-a6d8-19b46a10340f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886653, "uuid": "928fe852-6c6f-4ad0-9c53-45958c749654", "value": "130de76d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb8c47a-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868572, "uuid": "b397db14-2a9b-44fd-be12-c5eafbfff932", "comment": "Malware payload (Dridex)", "value": "d10c025888275554df96987a47c1abd5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868572, "uuid": "54acae12-8871-423d-8a74-2dc2dcb40264", "comment": "Malware payload (Dridex)", "value": "792fe126679d54b63f8c613c069c591e05beb38621f81bb1246da827cb672b2a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868572, "uuid": "241ade27-455e-41d0-be17-523dc895b220", "comment": "Malware payload (Dridex)", "value": "17b65edad3955d7908af5e5ec2807f0fe57186e3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868572, "uuid": "28a2eae7-a3b6-4cd8-abaa-e0c6f4330d0a", "comment": "Malware payload (Dridex)", "value": "017a3eec39fea199c774abd577ed10b1f7cc64315b5593e2b409abd38b38dc85b9eddbdfeb544a5cb9aa2c9d4a05f424", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868572, "uuid": "c7b931cc-355a-4d74-8a07-8953f02a8204", "value": "AAF3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868572, "uuid": "938e2f70-f1c2-4223-993c-347cea68ac66", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868572, "uuid": "4172f227-11b7-43e7-b3c6-28f57979ff04", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868572, "uuid": "d2e3b224-ccb1-48d2-b4e2-e2dce159a59a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868572, "uuid": "afa29439-b995-4cba-a134-03739cb24a41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868572, "uuid": "4a48911d-9223-4074-946f-60b2402b3a96", "value": "d10c0258_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6f753c-bcd2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621889855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889855, "uuid": "93ea8d63-dbc4-4669-9da7-b5c7e5bce6a7", "comment": "Malware payload", "value": "ae55a2d27e55ff096c6903ea56a15a36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889855, "uuid": "0b9709dc-2ef9-436c-a8ae-1c092295f650", "comment": "Malware payload", "value": "7a5476a403292d05348c16ff227edc31adde7c3bf2ab4b5910ce8d5470fceed8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889855, "uuid": "c9c6fa3b-b26d-4c1f-8e76-fd82f9201e32", "comment": "Malware payload", "value": "1109b05a026f1e0d946aa6b718515e8c954c11df", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889855, "uuid": "6e78a087-8f2a-4eba-93fc-3c9d59195a91", "comment": "Malware payload", "value": "c0139af102cf30ac9834a168a1b102a2d0fb41be8fb689c4e31a0fe37334657337b0ec207fbfa6864e6da0adf08999cd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889855, "uuid": "ae935b24-2bb2-4786-bd96-bacd300c2232", "value": "C525D01CA129A131F468C23945D3B127ED18CB736021A9559AF70B5F3F37EC0BB8A5AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889855, "uuid": "d06ca7f9-096d-4044-8b2a-4893c104935e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889855, "uuid": "e2247e3b-39de-46bf-9544-5984377151eb", "value": "12288:e9kwTngnyIqYPlhapXvE5RO4v4NZ2igaBxIK4Gnpy:e9kognZqohapcy4v4328rIK4Gpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621889855, "uuid": "a60efc81-e3e1-4d17-8501-595eff368c8c", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621889855, "uuid": "127043e7-e33f-47cc-932f-f910f92db4e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889855, "uuid": "86104d1e-0021-4967-8e69-698798425032", "value": "Signed Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac12db76-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893723, "uuid": "c384117c-971e-4216-9d89-d07d98556ded", "comment": "Malware payload", "value": "4c973284385d9aca65f28b3636179e81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893723, "uuid": "bc9fcc9b-2a75-4c09-9f6a-d321df02dd45", "comment": "Malware payload", "value": "7a9004c687a777ac473876853c63504f5b0b01d65b595485ac7c20585cea0af3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893723, "uuid": "dbdd5917-6aba-428e-9aac-65b63314e81f", "comment": "Malware payload", "value": "f08279ec33778f8de4481ba52f9521905616dbc5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893723, "uuid": "07989bb8-b6d6-4b07-8a7c-3f9a9e8591aa", "comment": "Malware payload", "value": "24a5e0426559e98581dbf97826b4215bac9461a45bcd68e59077225f15aec8c64f121b595abe46c843d976ebd03d2b3a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893723, "uuid": "f53c347c-bdbf-4517-bc1b-7d7543ad5432", "value": "54F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893723, "uuid": "7e531fcf-2397-4ee3-a12b-92e7cbca5dae", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893723, "uuid": "2fb0ceb0-6b8b-4adc-81c3-8e67f8e2c1a4", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893723, "uuid": "6994425e-3e75-4e22-86e0-9dc118f2b90e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893723, "uuid": "b9ac89d1-59af-4c1b-afa7-6ac7dbaf27ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893723, "uuid": "a5dfbc86-0d48-4f01-ae72-1bf28f21a9bb", "value": "4c973284_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ac66fa-bc56-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621836324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836324, "uuid": "fc3a3815-364e-4c0f-a08a-fd726a1f6fd0", "comment": "Malware payload (AgentTesla)", "value": "75629f37b64200246562aefa1f638ba2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836324, "uuid": "590826bb-71d6-42d8-9cb5-89ad2766f7eb", "comment": "Malware payload (AgentTesla)", "value": "7aa20952bc30855f4c2c818105add2bb01eb766502d83a23d832360f7b9a2bfe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836324, "uuid": "4ebcf8e6-668f-42f8-a0f8-83f793d4e8eb", "comment": "Malware payload (AgentTesla)", "value": "27737f991811cc9dc826be181484ed944c3de2ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836324, "uuid": "e24e3aee-b66e-46c0-88b8-6d8a52e12867", "comment": "Malware payload (AgentTesla)", "value": "1c378f6918499bc693a9a839cfc97a897ba325e1a2ccac136d7477ef499cbcc7b4dae5cb9f35909ebd61c77afa80aac6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836324, "uuid": "d4bbc7e9-ee2d-46db-8d1a-451280fd4ee2", "value": "FCE433CD45E3EA692F43BDA8891C8D909EE582C80854FE750CDA5693FA03751F5ACB0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836324, "uuid": "bebf8cbf-3909-4098-a427-65edd20770d1", "value": "12288:mWKiW6ydn9T2pycJU82jTyb2loxUFnIHpS/rqyQr6A4DCofe1R:BKi2dANeljTVGxaApSOyo6fFfe1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836324, "uuid": "e2be59a4-2b9b-4ac5-9ad5-b0cec6dbbb5c", "value": 717827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836324, "uuid": "6ad2f4bd-aa06-42de-9790-da52afc2d602", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836324, "uuid": "552cd03b-6d32-4897-a2dc-b7333ef27fa6", "value": "SHIPPING DOCUMENT & PL.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a31024-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854084, "uuid": "19b1790e-1a2f-4a2f-83d8-cbb3e2b48a9e", "comment": "Malware payload (Dridex)", "value": "1b457a92aa872dd305d6265e98934b42", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854084, "uuid": "57121ae2-1c3e-4771-9a32-c1f3be059985", "comment": "Malware payload (Dridex)", "value": "7aa8e7ca03c429969c7aeb299f26dd4fd2421261d0e76e48b50d37f148b1643f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854084, "uuid": "b5f30b92-2570-4263-8cd7-df39b2d22527", "comment": "Malware payload (Dridex)", "value": "6c91ef446f9ce619eda2de7ca2d4a6dcc0d3ed81", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854084, "uuid": "7d226cc2-690f-4592-8110-74e59bd7d5fb", "comment": "Malware payload (Dridex)", "value": "b50ce2f47a535db4d84746b0d31165176395aadffa15a999341740bf4fe01334b79bd6ec1a69c525bd53f44361bbce5c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854084, "uuid": "f81696a2-8bf5-4425-bb65-11d86ad51de9", "value": "3BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854084, "uuid": "b337d066-f628-4291-b98d-c2690f5c2d39", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854084, "uuid": "e625e2c8-3775-4601-aa29-a2ff65666b8e", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854084, "uuid": "8902c4d4-969f-4d4b-b4b4-a7deee94b755", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854084, "uuid": "0bc15fb2-1418-49de-bb3d-2d93f1c6fc2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854084, "uuid": "f8d1332c-8a92-44ac-979d-ee13e052e945", "value": "1b457a92_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0126117-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872335, "uuid": "cfe1a38d-35ab-4968-a8d9-ea10cffa3a00", "comment": "Malware payload (Dridex)", "value": "93061cb51b2fea6f028391973ab6c7bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872335, "uuid": "4f84e6c9-49ec-463c-a639-b93d722ca2d7", "comment": "Malware payload (Dridex)", "value": "7ad2e208208a3ee73223d64fdfec85d106dc3f5129f42207039ecaf13dc37801", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872335, "uuid": "96047332-015a-4bc7-9cb0-6eab47f4b338", "comment": "Malware payload (Dridex)", "value": "551632312e0f43028d9ac762f629451c2ce668a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872335, "uuid": "71dc8333-8e3b-4311-a55d-b8a6c51dfe71", "comment": "Malware payload (Dridex)", "value": "7fb2610a5f4a924355705735938ca1bf52bab46f24401723a02875c5f78c1d1a3d2ad007450e8117ce391bf49706329f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872335, "uuid": "741f5e30-01b2-4894-8f01-e079d96534b7", "value": "7DF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872335, "uuid": "7f472130-0153-4f1e-b173-2a8148904191", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872335, "uuid": "fb722568-3a8b-43a8-9698-fc221554fe11", "value": "3072:KIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Dc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872335, "uuid": "1e098879-72cf-4610-9b08-3b8c9007598f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872335, "uuid": "e6d1ad42-dec6-4c62-b7ba-dd22c05403e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872335, "uuid": "d963921b-f800-4395-b8a1-2f789f96e110", "value": "93061cb5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fbcc60-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864859, "uuid": "39a745b6-752a-4555-ae46-c9fbbd4057e6", "comment": "Malware payload (Dridex)", "value": "e542acd67fa6b2fb38656b42d1460304", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864859, "uuid": "c67ca897-02b7-4d31-87cc-de7e9a8519b0", "comment": "Malware payload (Dridex)", "value": "7afc433c9de7cb7dc574a79f6b497dd5e7ead1f41f5518d77499ff97d7fa1181", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864859, "uuid": "e4ca5e4e-63ee-4470-bf26-6a7ba863ce03", "comment": "Malware payload (Dridex)", "value": "c5d47c3b923647642d5b8cac801abc67179b103d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864859, "uuid": "9ac9e570-1012-450f-b4b7-0263e650ca71", "comment": "Malware payload (Dridex)", "value": "e7f458ddc25315d90faa72b2d1dde81c7eadab10c40da89002b278a3d9ec6ef450764cd031958200a1bbde9aed8d51e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864859, "uuid": "7cf4de1f-84ea-4ab5-97fd-ba8bccea1e9e", "value": "54F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864859, "uuid": "ef48e6cc-0ddd-43fe-a2fc-9722e65d3842", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864859, "uuid": "d0202d78-8b6f-461f-add1-8c42302dea30", "value": "3072:gdmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gcLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864859, "uuid": "c30bb9aa-b84c-4dfe-89b7-3f5b6048e278", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864859, "uuid": "7a4a7d1e-6814-4765-b2cc-898113de33fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864859, "uuid": "ce10244a-5e4f-4398-9e93-d4614be00092", "value": "e542acd6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fecf478-bc7b-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621852256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852256, "uuid": "1e1a47d8-a7f4-4ae3-aba7-2c21dd3f8bd5", "comment": "Malware payload (AsyncRAT)", "value": "d3e8bacfa3a35f43a26772be547d48a9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852256, "uuid": "bdf869ca-5fe3-4838-b5a1-b882aa61e652", "comment": "Malware payload (AsyncRAT)", "value": "7b579694a738437eb6aed2064bd2d78cb77d8afe92994bf6e02016a563cd50a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852256, "uuid": "b9ea4850-a365-4ed5-9712-51f478510c29", "comment": "Malware payload (AsyncRAT)", "value": "8f786e0b66ee92e0a71d88cc0f17296e836c8e17", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621852256, "uuid": "381d1196-7340-435c-85e1-713d11b52f97", "comment": "Malware payload (AsyncRAT)", "value": "e9362fd08a1feeb5a345bc401452ec4dc3a74d801a64f058d59b69d394e462ccb35633c5779e251a31311684886aacb1", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852256, "uuid": "cd370888-aa8b-42ad-98c2-a6b5867843f1", "value": "64E633127585D633DED54C32046C9B5B0A64BA211F0693AE8BFC8569ECE28F1E334F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852256, "uuid": "dce6c050-0737-48b4-9365-164c936d5396", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852256, "uuid": "df98749d-99e3-4c69-97a1-e46750f683df", "value": "393216:0YZvGNO+a9vucnCO7BSs/DCpdSwx0A+1QEcZKfsmvT8:00GYUcnV7BUcfA+1NXsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621852256, "uuid": "72864ed7-bfa3-4697-bc09-b767061ff9ee", "value": 14819256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621852256, "uuid": "eff19629-3daf-4696-8cec-73dac77c293b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621852256, "uuid": "0b979255-d1a4-46f1-b998-4b2ccff90d12", "value": "d3e8bacfa3a35f43a26772be547d48a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fc9eb3-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846849, "uuid": "f3cb0e75-a0ea-4c68-bf1c-9c6f358aa440", "comment": "Malware payload (Dridex)", "value": "4ea4e4991236b08f9bb405cec3a34069", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846849, "uuid": "bec87e3f-9b31-40a2-b229-cca6672c96fe", "comment": "Malware payload (Dridex)", "value": "7bc274b7f9685898e18186c59fa67d058e7de7362a1daf322f7be5cb80da9517", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846849, "uuid": "03bf755c-d9d4-45f0-8590-6a9207fed856", "comment": "Malware payload (Dridex)", "value": "2df556601b4981c71fee2bfdc91aa43f0e3bacd2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846849, "uuid": "1da5af38-da8d-48ea-8861-705edd7c3f9f", "comment": "Malware payload (Dridex)", "value": "5d2ad70639fa719c5406043ddb8cc75843dc1db813112ed5ea230c18f7510a0e409446ce72bf8233fc8e8d9b626ff004", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846849, "uuid": "b60d4d0d-ae82-4f80-bd3d-228bbe27dda8", "value": "00F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846849, "uuid": "217a5c33-e041-4389-90f5-64a7a797f131", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846849, "uuid": "1aaa5e85-b692-4318-8b64-060e2b3d2883", "value": "3072:xiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:CeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846849, "uuid": "d9e228c7-6aa6-448f-a327-6553decf2bb8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846849, "uuid": "707533fc-99ff-498c-a724-5bdcc944ed45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846849, "uuid": "7cc10238-df2a-42c7-8008-561d2d2c6db9", "value": "4ea4e499_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0597b455-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621837609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837609, "uuid": "1e8dcc49-e1d2-48ba-b904-2aa6b144b03d", "comment": "Malware payload (RaccoonStealer)", "value": "7a1f80468c3aa870a2d0eb8e02adb796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837609, "uuid": "be391196-c891-433c-b84b-60ee125cd56d", "comment": "Malware payload (RaccoonStealer)", "value": "7bd8a1e4619432240da40627a5b05eed35e3ba0a83ca329f9b5b0f8efc86c2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837609, "uuid": "775ece5d-20fd-4a39-9073-84fa00227165", "comment": "Malware payload (RaccoonStealer)", "value": "9128868ade2a496e4d9ae7b986c13f32c6eede7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837609, "uuid": "01a11361-801a-4a0c-ac8c-cad7631051c4", "comment": "Malware payload (RaccoonStealer)", "value": "ab76697120a2a24faa4c6054b91cd2ecbf25e45231abb2ebac11a6c284e4bf1212f10192d6554fea8c4a67077192ec79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837609, "uuid": "db4c4128-cbe8-4680-85de-84165661c492", "value": "EAC4D02076A0C077F4BF11F449B58AB8653A7DA16B3480FB22C63AEE56346E49D3075F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837609, "uuid": "3df074d4-c8d6-4ff7-b403-3deace382f76", "value": "48d2401545bc23ddf9125d8d09f6c7f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837609, "uuid": "860462f3-6145-474c-830f-c4779f34867f", "value": "12288:b9h1LeUbp6grKFKJtfG7s2/MTX3CiABM2+XsL:Zve4rzJdC5/Q78IXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837609, "uuid": "2169fb9f-5c19-4e1a-8ef5-f51ecde151ab", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837609, "uuid": "7e9f5a04-e26f-497e-8fd0-4939595eb343", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837609, "uuid": "e1b40289-713c-4c7b-8180-efc2cc320225", "value": "7a1f80468c3aa870a2d0eb8e02adb796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a57926-bca4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621870066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870066, "uuid": "3930337d-1a77-4ec3-a9b8-dba4d5b63f13", "comment": "Malware payload (AgentTesla)", "value": "fef3f456aa10a8b3b93586c7363d327a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870066, "uuid": "00766a94-f18c-4005-8379-020a6608148a", "comment": "Malware payload (AgentTesla)", "value": "7c160d6aa07d28c5eacf5b6cdb36db5cdb46db9fcb708289a9f3e02a2af39730", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870066, "uuid": "84146792-a509-4d60-bd15-c48eb06f86b5", "comment": "Malware payload (AgentTesla)", "value": "a0fd7b5bc2ea4869c92456c0e07a1026383a2707", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870066, "uuid": "5ed11577-a569-41d9-8280-b4b27a9a6b3c", "comment": "Malware payload (AgentTesla)", "value": "454808ac02a79f9aeff2b421537a552610fecc887c0cb0c5d8dfc1c4b0cc6a486b4341e1a4881116db7567e2ff7280b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870066, "uuid": "84b02b5d-8aea-4334-8754-33d6b4c7cb85", "value": "1A9129B44A280C57FEAE04F6E574BC6600D2F22596CB6A00317CEDE20B6F3609A76756", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870066, "uuid": "7b000165-3e05-4f65-b45b-a793211e9592", "value": "96:97ZQHg9eKp+w2Pnzz8Hrif7oH3YgykKj6ediRiLCih:97Zcg9VpGPX7odvELCih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870066, "uuid": "914d4981-8baa-4ba3-b2a9-bb4c10da4a21", "value": 4257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870066, "uuid": "7392cd9e-6b4a-4ffd-aaf8-8c4ab3da1eaf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870066, "uuid": "e2d48b8b-a723-4757-8136-524bab7eebf2", "value": "updated PriceList .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acb8960-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850530, "uuid": "53c77630-0a97-453a-bfee-26b668f83aff", "comment": "Malware payload (Dridex)", "value": "ac97a6e8ac6a38f398416bfdaf20e714", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850530, "uuid": "e71fe980-acef-4561-a1fc-b5b09d240cae", "comment": "Malware payload (Dridex)", "value": "7c73eae89503d357e59e2fa11e64c42e2b24dc91d0c6ba08517a041006dc15f0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850530, "uuid": "e2a4918f-1c40-4895-bd4a-a8eb3d68d476", "comment": "Malware payload (Dridex)", "value": "c141ae84279c007c5abe4abef9364431ac93f7e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850530, "uuid": "fb5a5ff7-bc53-421c-8339-73e4258e3c0a", "comment": "Malware payload (Dridex)", "value": "3299e956fab117b61a465e80e037fe251633fe3b33aabb3b4efe85f9d9ffd58cbe1296a9a7d1f03a4471aa00e685ac11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850530, "uuid": "5678894f-38fa-480f-9810-67271506d77f", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850530, "uuid": "13300167-c683-4995-86f9-2379ea6f0543", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850530, "uuid": "b051462c-83a8-404c-8d9f-97c317384937", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850530, "uuid": "70455d93-3d2c-4410-88d9-ab0382dd2692", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850530, "uuid": "704a0ab2-c35a-4ddf-bc71-dc8bd0556787", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850530, "uuid": "1f21afbc-ab2f-4624-8fec-d755c6fa4508", "value": "ac97a6e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec827c8-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621865005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865005, "uuid": "f94efe0f-7302-4a56-80f7-e860d625ef01", "comment": "Malware payload (Dridex)", "value": "d52fdf048c28ab567b88303792749aa3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865005, "uuid": "b1950f91-bbac-481e-97e5-b6963ab3378b", "comment": "Malware payload (Dridex)", "value": "7c9f76e7ca3e3ceaff339b7f5f7286b350a758540eba79424cdfd199aaad55d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865005, "uuid": "73ef4734-12ee-47cd-a17a-7ca48988e930", "comment": "Malware payload (Dridex)", "value": "d68587706e4f4c7d690ca5148f169c9213fd8371", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865005, "uuid": "64b13565-f027-455b-b2eb-389bf71f28ac", "comment": "Malware payload (Dridex)", "value": "385a807899e77a5d25734488a6036385461b702a09bb9ae9a437b6ff2e9cc3a9c1582e1560924c5cc3d8aa20a22133d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865005, "uuid": "9ad1a63b-da30-408e-b890-8579044682d6", "value": "2BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865005, "uuid": "94172561-ac93-40fa-a434-3cea39b3b687", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865005, "uuid": "fd266add-525f-4c80-9a4e-e6de8248c635", "value": "3072:qmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:7Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865005, "uuid": "801d6028-d3f8-451f-9d10-7375cae64349", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865005, "uuid": "112d8ee9-55d9-4d84-aa60-8fab0f6529f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865005, "uuid": "cf4d08fe-52a8-401e-a20a-2c8c9d3c7594", "value": "d52fdf04_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "537f60d0-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621838169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838169, "uuid": "b459b6e5-9be9-449a-98d8-c95cf0956355", "comment": "Malware payload (njrat)", "value": "ca637caf529f158575c7bd973d946b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838169, "uuid": "a7a9e7e9-04af-40fb-810f-f06cefae8597", "comment": "Malware payload (njrat)", "value": "7cf4fafb7d41c7c48f1078e94fa059ad3a666786a74c9864238f251c06298c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838169, "uuid": "40cc45d6-af74-458c-93b5-938f34757ed7", "comment": "Malware payload (njrat)", "value": "ddb5765b78eff341d99b4c8c1bcfd6d1b08140d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838169, "uuid": "4d0fef58-db8a-4d0e-9741-1f664fc0d869", "comment": "Malware payload (njrat)", "value": "876485d0af14123a4cd2612f20bbe803c41dfc335524ba5428b7ed8c66470f3a203c9b7243d9d888946f15c7b87319a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838169, "uuid": "8b6f429b-48be-4d72-a86e-4c36ce873745", "value": "73F3E86FB6488F45DA982876D0EB942003D1AEC71733F2463F597B6D08623E39D897C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838169, "uuid": "ae53fdf8-269c-4277-b1f1-d7b595bc4e8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838169, "uuid": "b801754f-4233-425c-9dbf-50bc9cc11a47", "value": "3072:VtbJdndB5tzSidBRDTuoE/WvFzjh91bNePshpdQu:/nndB5tzSidBRDTuoxFzFbNug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838169, "uuid": "54643b2c-d6a1-47ca-b104-602bd89cab08", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838169, "uuid": "5a6ebb42-76f7-4dec-991d-b53b9e6a77db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838169, "uuid": "f065c636-fc97-48b1-8378-64dc7cbf2470", "value": "ca637caf529f158575c7bd973d946b31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff3b908e-bca6-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871099, "uuid": "a84e9edc-6070-4a9b-bbc9-8aeadf885866", "comment": "Malware payload (AgentTesla)", "value": "9fa7e69e5bc69543681ed22606375a33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871099, "uuid": "fb5511a5-cd2d-4f7a-9c22-86cc4c4109d8", "comment": "Malware payload (AgentTesla)", "value": "7db537fd54beeb28ab5f659a3e86d2e4afe5b964815def54a4af5aebe4c84889", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871099, "uuid": "53102a3a-e782-4aa7-afd5-7f7ee586d456", "comment": "Malware payload (AgentTesla)", "value": "3eb7b9d99b27d17ae1ab5de45d98a4964c1bed64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871099, "uuid": "c999ab73-2aa0-4d59-ba27-87b0a7a93ce7", "comment": "Malware payload (AgentTesla)", "value": "73f4bea164bc7b8927c38da4a29fdacc1a20151a3fd385979c8be2fa116cfab60ee57e5481433d714f327557f360634f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871099, "uuid": "91d716fa-b121-4ef4-9cab-73e5e668ad84", "value": "ADC4AE51B2F52F56C4B98BF528656A8407B67D0FACBCD61D0EC230CF1AB1F1186A5B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871099, "uuid": "d963f72a-7183-4cf5-97fe-0b408787722e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871099, "uuid": "bf2a4ae5-c88e-4b8f-b5df-6431950f108e", "value": "12288:Q+xL0AmJvXYDnDRw/FTJJg0qlJkZ/L/U5jKfDCfCxUxP:I+DcFTJJgnkkWDqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871099, "uuid": "6ad880f8-5420-4515-9c44-7146e23b081e", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871099, "uuid": "cc8a3515-397a-40a7-a24f-56955dbf6421", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871099, "uuid": "47b5652e-2bc0-4eeb-a152-2c26d212d880", "value": "Payment Slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f8ea3b-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850678, "uuid": "38797032-5b4a-42a5-8d78-49037f0e844a", "comment": "Malware payload (AgentTesla)", "value": "f2393b2908fdb07930d0743da4b732a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850678, "uuid": "0036df41-135e-4e04-8939-b16ca2d757f9", "comment": "Malware payload (AgentTesla)", "value": "7dbdfe2fc6efd3197ed404f6de2fba3612c65115375ab0c3409ead24ab4877cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850678, "uuid": "1a9519c9-bb2e-4174-92c0-eb1ce9743071", "comment": "Malware payload (AgentTesla)", "value": "1e9bf3c1d4421d731a5639c7fd47c9c6707dbd4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850678, "uuid": "9013cae0-3165-4776-bd45-82f7a8112029", "comment": "Malware payload (AgentTesla)", "value": "9aba9ccd18c2c7644b918972a3404184255dfe5f7294baa0f799b313203dc7037ab5c93d03bcb448d4adbf82f6aaebe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850678, "uuid": "bd812658-10e5-4a32-a265-a165961ad014", "value": "0374129412E4C02FE2631A35AE77DF39F2F66B052A3015BB1F111FAA6C15256F42838F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850678, "uuid": "44da38c6-90df-4df7-a093-457b4c5647f8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850678, "uuid": "4f3bed75-0a1a-41d5-aac0-30851e796c74", "value": "6144:LsBez5nmHkOLFJV+lC5g9p3G4AfX68c6DJDnXhxpfQsVw:eAnmJLF/+C5g9E4SxXhDIIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850678, "uuid": "55f36cab-fb0e-439a-a575-efce1451cc82", "value": 350864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850678, "uuid": "372f7797-2a66-4b4f-89d4-c10d748e72ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850678, "uuid": "56d7c4b1-5b6e-433b-9c40-7c3d0567b99c", "value": "S.O.A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747aa299-bc5b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838654, "uuid": "9625eff1-d5a6-4df1-a673-080633314cab", "comment": "Malware payload (AgentTesla)", "value": "15fd83e5fbe925de94d808b56c7f95ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838654, "uuid": "6e569856-3b7a-4e15-b3c8-b615fd3126bf", "comment": "Malware payload (AgentTesla)", "value": "7dd5e15b5f62d3164bfb8e3edb8caf171f9a1c97df8f213ed7920f79221c524a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838654, "uuid": "67083139-cfc4-4e4e-a98d-2602f3506204", "comment": "Malware payload (AgentTesla)", "value": "105e38ae5fd883174679c91c217c2dd1a41230a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838654, "uuid": "569df099-522a-4b3d-aa5e-2754f8d40430", "comment": "Malware payload (AgentTesla)", "value": "b789437abab36fdd3328bf09cb0452468ece38c6ca351bc0388a1e37c41c3f84617522e824f5f6840322404f8eb55049", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838654, "uuid": "5ab42f52-f45f-4fc1-904d-a537f1152c8e", "value": "42A423BF05CCFB7B5CDFDF61FB4382F5AAA122C94C45446F8601B850A6D45A0E21A8B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838654, "uuid": "e25ad0ea-aa17-414c-97b7-45cfced1be67", "value": "12288:QHBZGtZE/D4gjM4ZBW0/+SR3GQvRbTRkX0e:ftZs4gY4ZBW6+SR5baEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838654, "uuid": "d93b9ace-3c1b-42ef-9489-3fea7b21543e", "value": 452515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838654, "uuid": "199ea777-6589-4029-87bf-cf9d1e39fd5d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838654, "uuid": "e7a1f064-4c40-453e-8105-9c7387475216", "value": "PO.CF004303.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8235c7c3-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846838, "uuid": "90404eeb-480f-45c2-91e4-f06f68b51c98", "comment": "Malware payload (Dridex)", "value": "68b004f53539ff60708556eed76c783d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846838, "uuid": "d0d5fec7-0ba0-4b0e-8c0f-c580927b499b", "comment": "Malware payload (Dridex)", "value": "7e4e6a55e5e723354981f8d3f3c490b0bc743ba5ee479dd9860b3de627cc14d2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846838, "uuid": "42af3754-ec2b-4bd4-b1cb-6c525db7e009", "comment": "Malware payload (Dridex)", "value": "d0f87371ad00c8dec38fb89fafb1bc7d4dd9505d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846838, "uuid": "c656f792-aa20-4fce-ad91-a5c343c358c6", "comment": "Malware payload (Dridex)", "value": "0a09a230ced92cbbf9a54ff2298a6199e467e368e8657c50f2a90c6c066a15b7a4585a30d969d2a47939ec81b5c44b32", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846838, "uuid": "937e0f01-7133-4905-8b74-9d3d042cc0d3", "value": "0DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846838, "uuid": "105b7787-bb09-4a6e-8f63-32e5494ab128", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846838, "uuid": "41e4f5fd-9f8f-46ed-89ef-b8b3f3879947", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846838, "uuid": "a1bacf08-2154-4c86-b78f-793f8771b5f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846838, "uuid": "6b98e501-be78-4b7f-b801-36bb4b90d46c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846838, "uuid": "7d003ba7-f128-4185-8bb0-0debaac044bc", "value": "68b004f5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcff0ef3-bc96-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621864224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864224, "uuid": "8c944056-a7bd-452d-895d-84c35bf46416", "comment": "Malware payload (Formbook)", "value": "e7c9136b07711a3bf7b1a46b7009b4f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864224, "uuid": "0050e7ef-0ee6-4bb5-b4cd-258efd893b4d", "comment": "Malware payload (Formbook)", "value": "7e595e94b08c3bbd600f3fe1c310a6eb20b85e0784d4f519e713bb6a5e53446c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864224, "uuid": "67ff2129-809a-4244-b6ab-080a9192120b", "comment": "Malware payload (Formbook)", "value": "9ed96a3ee33432ccd025815868e6bbdc42aa9d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864224, "uuid": "71f5c0a9-8117-4f73-9823-5c29b3d2555e", "comment": "Malware payload (Formbook)", "value": "e244fed9e2a54cb26938210655c1d005f433d6ae2bd8590cd4e58585cea8659a3ea3230ea6499d5b44b2afe3e504a5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864224, "uuid": "c53be804-df7d-40a4-931e-6adee4335e0a", "value": "42157B2C516EF126C1A9C27946C4C43BE590DF373132BE29ECC35F9A6719E41B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864224, "uuid": "5e418c5a-c9bb-42e4-940e-02f7f3ced972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864224, "uuid": "2a6e6c31-31fb-41b9-9dff-005cca994b93", "value": "24576:4BCkHIrwPmy6Hzop5ZE25cta9gqqzLRUhhGHiY:4BCkHMy4ufB+tWgVmUCY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864224, "uuid": "05ebca2b-596a-4be6-aaf3-0b85fb7727e4", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864224, "uuid": "606403e0-2166-420b-9ffd-3556ba518bf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864224, "uuid": "85d63508-bde8-44c3-a0f2-300a087ac723", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349f7984-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621871189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871189, "uuid": "9b656b8b-888e-43f5-a51d-36edc6e06187", "comment": "Malware payload", "value": "f34b7d974150dae553527b57891187d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871189, "uuid": "e4057081-12fd-4813-bfdd-cec9e7dc7f40", "comment": "Malware payload", "value": "7ec0013035b5a6c21985a1094de2f2aace63b0b7a3cf2262798a1bffd19aae8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871189, "uuid": "4223920e-7f2d-40a5-86c0-bcdaf49f7afa", "comment": "Malware payload", "value": "b078a717721b8a16eb9af21425a0289cca8f26fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871189, "uuid": "0493d3df-6f69-4ea3-bfc0-6c2ae3246156", "comment": "Malware payload", "value": "a04e16f2d531205a88910c41fc92449275812132dc17006f95d52e70d02954511ab4d6fff3742b92ec98e427d5d205d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871189, "uuid": "ad84c9eb-093c-4365-af37-0d5e262960d7", "value": "B8357C9FFB98BE69C12D4E358043590997DCC4573336F3AF46D5A0E3AC11B8A1A4E1A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871189, "uuid": "af008d06-05be-46d2-9ba0-0f8d67431adb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871189, "uuid": "24fc1d38-10fd-468b-8bb0-fd0beb2a18af", "value": "12288:WP0/P1d195fdrXoQHC4iaOs7GLhrZTL9kIEUTRWc48GvgsnI7pyRK6xXLyEpRUQX:WKfJfB7Gb/S/vYsnq2cEplKQGOk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871189, "uuid": "a17e3188-918a-4ea7-9ec3-45ebbead7da0", "value": 1158144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871189, "uuid": "c636b821-d93e-4cad-9ed4-71608a321f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871189, "uuid": "c2b49308-fd40-46df-8e21-9b8955e226c8", "value": "PAGO-SALINGOPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9eb61c-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843288, "uuid": "e8815de8-c236-4ddf-912c-233ca3dcd0d4", "comment": "Malware payload (Dridex)", "value": "c9b7310e8aef5b139274cd907a318bc4", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843288, "uuid": "30b0ebab-4342-4258-9361-2230dba4b5d8", "comment": "Malware payload (Dridex)", "value": "7f26274cccd5e2efca099a519fd903956ba0822a406df6d770684e4df94ee40f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843288, "uuid": "6cafb35a-0f2f-4831-9289-22beb75b9fa9", "comment": "Malware payload (Dridex)", "value": "9fa5c0d9dfbe495a313a2602f9232d55842b4920", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843288, "uuid": "33b0b6c2-90f8-442b-97c0-1566a7247a3b", "comment": "Malware payload (Dridex)", "value": "a4b950ee949042bbe5df19e27a090bdb91fc5acc92471edb9f9e70ed16a460c0fe02198b65c8ef26ffe4d07451865449", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843288, "uuid": "2762e199-c150-4618-a3bd-9574a4ec9ac3", "value": "D804B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843288, "uuid": "726c45f0-f9de-48c6-9c38-9b5fc14c152f", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843288, "uuid": "b3a4658d-99db-4fca-90c0-b7d4d84f3446", "value": "3072:tWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:tWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843288, "uuid": "8d30e2c6-0e98-44ad-a556-c4b8cab110ae", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843288, "uuid": "ddb29e6f-8315-4229-a2ad-350191ea5866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843288, "uuid": "168afd07-330d-4df9-90ea-6f802dbe19fb", "value": "c9b7310e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ebd2ef-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839858, "uuid": "01869c84-5b37-4d4e-aadc-422e3281e5ba", "comment": "Malware payload (Dridex)", "value": "f1f8e43415d2fe0aeec73f23fee984c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839858, "uuid": "d2cf657b-1642-48fd-859c-277d6eb5febb", "comment": "Malware payload (Dridex)", "value": "7fc116ef456fc6ef0d328724514386f193e6d14e1298820af933f92cc4a7b295", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839858, "uuid": "7ff86026-83d5-4d2d-8134-e2ac62b5113f", "comment": "Malware payload (Dridex)", "value": "bcca62135e14c44ca09577948f2e0b0e5fbdae18", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839858, "uuid": "60cb3b0e-2913-417a-9f87-f01adc317396", "comment": "Malware payload (Dridex)", "value": "0bf976086ebf736b637500d3016a3d1e0d1decf6b1a7cc7d124d80f9bd468f0221bc994b60c461eb747ae1d97af1a8c7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839858, "uuid": "0c93514b-2eac-43ed-a03c-f9e835c78548", "value": "94F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839858, "uuid": "da599f82-1522-4966-8132-81fa0343489e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839858, "uuid": "12997bff-dde7-4ca5-9970-6cc4d45d13be", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839858, "uuid": "ca1e6038-0799-4285-895c-b69d530c4321", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839858, "uuid": "875508c8-852b-41ca-801e-b17e4d9d09db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839858, "uuid": "f3070202-da80-46cb-9a39-aed50c881cb1", "value": "f1f8e434_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed766103-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897269, "uuid": "e458700a-e25e-499e-804b-779be8866690", "comment": "Malware payload", "value": "050aaffbce50bb6e5a4b4bfe924eeac8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897269, "uuid": "19514c22-c06b-405a-a9e7-90031707356b", "comment": "Malware payload", "value": "7fcc39b6528b28565db9f7872e2139b60ca929c2ddaf0fb79569f0d00c4d9c9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897269, "uuid": "d235717a-d8c5-4f8a-a33a-44a53c1b5cf0", "comment": "Malware payload", "value": "d36c512d2c18427ac2fa38f61211a929676b7495", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897269, "uuid": "90b3d4f6-001b-47b4-b054-568f6faf92aa", "comment": "Malware payload", "value": "4ec9e1d451b3f6f7f06e7188cc18092339ee93c8b6db7b7a805f8872ffa130d87772530e5b6de0a0e04747b32778ea4b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897269, "uuid": "2a7e74ab-5289-403d-804f-fa04d78bacf9", "value": "3BF3D088CBB3E4E6EFB3D37866F85E1B561574551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897269, "uuid": "f99cbcc8-972f-40f9-af02-b958f88dd7b6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897269, "uuid": "89b810f1-6bf5-4ad6-8b30-1c36edb443ed", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897269, "uuid": "ace279d3-9cc3-4f8c-a290-428addd2efe4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897269, "uuid": "60120a81-4d75-4237-8621-20dd26c714ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897269, "uuid": "68f67bd4-b951-4973-8974-37de5c5c37c7", "value": "050aaffb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89becb9b-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836113, "uuid": "9341f1b2-42b7-46bb-92db-d25c20414aca", "comment": "Malware payload (Dridex)", "value": "d79a38dece7189a7d34f1ac0be8781b6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836113, "uuid": "817aa019-7303-4079-a58f-7f3979ef7a5d", "comment": "Malware payload (Dridex)", "value": "7fdc611fdbcb1522d52cb040467984ca201de77c125f7bbdbd8647fdc0601e2d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836113, "uuid": "542b7194-9bb5-4c74-b7c7-b8ccaa56a2f0", "comment": "Malware payload (Dridex)", "value": "3bab0fc79719ac5e1f158d7b60722012326aa7b3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836113, "uuid": "10a6c0cf-63b8-4c09-acd5-341fb307497c", "comment": "Malware payload (Dridex)", "value": "be5db08c5a0a8fd6c40620976be37085d55d9862a7648a659456317d214b56dfb0eb23a5e428f12c58bd137ee337e16b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836113, "uuid": "ac7c2a48-4218-41ac-b8ce-acc7fe3ba79a", "value": "34F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836113, "uuid": "10fc24f3-ff6a-41b3-8da5-84e4f122c8d2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836113, "uuid": "b3282698-218d-4664-9a2e-bfad8a3017a8", "value": "3072:ylpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:ylo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836113, "uuid": "eb2851db-3da5-48b5-ade1-3e8543d3a3b6", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836113, "uuid": "b0c06fd5-11fb-4a6d-8689-faa87a7b43d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836113, "uuid": "ed34d631-d6cb-4257-8b97-0f3cf1036a64", "value": "d79a38de_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "432bf022-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621870354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870354, "uuid": "ef3d35d5-ea84-4fd9-bf08-02bde4c3dedb", "comment": "Malware payload (AgentTesla)", "value": "34ebfe76dbb5f07de0cdb082f11bcd89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870354, "uuid": "8aaebbaf-1b2d-4fb7-a892-b0ad0b1e872f", "comment": "Malware payload (AgentTesla)", "value": "803126926bff556f5652673bf589cecac231e843ea4d7f5f1d2b625282addff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870354, "uuid": "6644127d-f14b-438e-8f09-d9be013d2c37", "comment": "Malware payload (AgentTesla)", "value": "334cdbfdb6b0c3c5fecadca7a354966394ba3089", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870354, "uuid": "cef56284-2351-4d4e-b978-e751cf96584a", "comment": "Malware payload (AgentTesla)", "value": "8139a5bb363df686c4a5b5c9b6861b86e45ba3711c46c51a66abe6c056c45fd44cde05fdd3ba3255ef0605937b6ce664", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870354, "uuid": "31139f67-067a-4d61-86b3-845841007026", "value": "97257A1CA199F161E06CC2784AD37027EE14D7336031AD55DDE3075E2F36E81BAAA2BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870354, "uuid": "759e1071-fadd-4f69-a65f-f9e7e5c4e7ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870354, "uuid": "38b4d3e3-6d11-4e79-913b-c659a44ea6e9", "value": "12288:AmMaCV75iBRIra/AQfcISj0h2HJRj5cW8mfX7/73lYYjSxi3s94pxK:AmMN5gIraoQWjP3xv3lYYOxD8xK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870354, "uuid": "767c91ea-0ee6-4dd4-8b5a-7d53246636f3", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870354, "uuid": "121a1eb7-6523-4174-be87-b2fcc0b7800f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870354, "uuid": "8f6b0cd2-74e7-43eb-9edc-5d2be831e982", "value": "TNT Receipt_AWB 87993766478.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437a551c-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838143, "uuid": "d3d8190e-7926-47b3-aae3-4c584541374b", "comment": "Malware payload (AgentTesla)", "value": "8726ec9ae4067033f57f0689be9122a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838143, "uuid": "5220b165-50e4-4b99-8b67-62d45839f143", "comment": "Malware payload (AgentTesla)", "value": "80b789937f3cd60d70d53f22e1a622d51714e5b2ff1527c1da377e6dc3c911df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838143, "uuid": "40d6a700-a294-4eb0-acce-1282b8e8b99e", "comment": "Malware payload (AgentTesla)", "value": "13e0ff14efacc7df05ffe333422af1cf53e55dcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838143, "uuid": "0edc4b99-de1e-41d3-bb28-0c0260c5a80f", "comment": "Malware payload (AgentTesla)", "value": "7b8fccb73a78454a681ce479da04ad772b56a654cf33fc094abc0038d2462facea7ad4d167a1a74f1e9f9cdfdf6e7b48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838143, "uuid": "b93c1d3c-762e-4c2b-92af-6f552e04c7ed", "value": "B5812BAD922C8D93C66E62EB8991FE420784B8D31DC319D5B81DF9B50B76324762B490", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838143, "uuid": "6dc07e18-bac0-4450-a062-df9b85a920ea", "value": "96:CRISPJGTJnuzPkmZDolmDDyeeqAHKd3/A9T7sw:qIy9AKklmXAqd3/Q7sw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838143, "uuid": "3c1580ab-8c79-41a3-a3aa-ca6c49c8b115", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838143, "uuid": "2cdecdda-2315-4be4-9807-3e907fd05dcf", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838143, "uuid": "ab68efc7-cdcc-4581-8d15-8f8b09858011", "value": "AL FUTTAIM NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70df0d90-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861411, "uuid": "59f90526-64bd-4b2a-b5e6-bf85a9823c61", "comment": "Malware payload (Dridex)", "value": "8e6f9e59156f5c7a00110e1cafe0cdb5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861411, "uuid": "d35647d6-6d72-49cb-befe-96fc69476af0", "comment": "Malware payload (Dridex)", "value": "80cab94b6554e43800c0674ad148167220c54240610371a252f156f6019c088e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861411, "uuid": "9bb19123-d2cd-4cc0-b099-06cfe8758f28", "comment": "Malware payload (Dridex)", "value": "7756ffee23c80ad4c127c8284f0542bf1742ef14", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861411, "uuid": "eaf9407d-92cd-4c31-8a2e-57d50402a145", "comment": "Malware payload (Dridex)", "value": "1c61b6636a59f62397d94c3297c6f586e5382520431b12c0b6282e15b3fb96d948cc1d3271c9127f3ac6f3baa48cac90", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861411, "uuid": "6be4baea-9ac9-4243-b479-eb03bfc8b476", "value": "33F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861411, "uuid": "17241053-265c-4328-906e-95b19f292a2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861411, "uuid": "e2036cbc-0854-4cc3-b48a-dcaed2839e31", "value": "3072:UmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:9Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861411, "uuid": "f97e9925-c2f4-4098-9b13-b4304722e57c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861411, "uuid": "f4ad4ca8-7eb4-408c-b620-5d089a81fc3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861411, "uuid": "94c14367-befe-4fa8-bc00-1733e00a24da", "value": "8e6f9e59_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc87bdd-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621821732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821732, "uuid": "781b32a2-efbc-42a1-ab37-2cadbee77411", "comment": "Malware payload", "value": "f0e1ad3ebe74f42489316437c9b82315", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821732, "uuid": "b320fa9d-3090-48f4-955e-7ff82a0f46f2", "comment": "Malware payload", "value": "80fa387343ca90cbf664963273f55ffbaaee5054041ac0723e9e51c4bf49645c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821732, "uuid": "3db7d517-a793-4716-9aed-0ff4a868ed45", "comment": "Malware payload", "value": "6d469b13f27b5ed21a1b5b5d334d945be3ef5c92", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821732, "uuid": "66e2235d-5b02-47c1-aab0-1913a6a6a8a5", "comment": "Malware payload", "value": "03e47753fedd9701b87b9ed7ee34d26361c2c6fbc7853d047e637c45c4dda5b67d40d0ff2ee77132f37029699c0cba05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821732, "uuid": "f35cb608-16cc-4c6b-ba01-7486e932bb0e", "value": "4204122E74C047FBD9F67411265369A9DC07A8E68C52ADA54B4B93F2321DD00F4CCBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821732, "uuid": "2df418d8-37ed-409e-8a37-d5e5e5077934", "value": "3072:hFSBHAuEMzv5JuTGbTR//RT5WhiwyqNu49m4DTtOszTJGrVBNZLSqbjElt0K1kbr:fSJAuEQ5JZbt/VLqxm4lOiTJeerzqbr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821732, "uuid": "3bbaa9af-92b3-4d45-b71a-10fd7cf8d3d6", "value": 176494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821732, "uuid": "95783240-ff8c-4f12-ae29-7d0416ca321b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821732, "uuid": "9c8edbb7-938c-4fe9-8c59-e26aace3fd32", "value": "f0e1ad3e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8ac2e9-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893667, "uuid": "ed347066-f330-4181-a7d1-0bcd469ab7ea", "comment": "Malware payload", "value": "a8e7ae13c1a211917714309a1ac3569f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893667, "uuid": "f507cc18-96ac-4e38-8149-898c129fc39d", "comment": "Malware payload", "value": "81510b51873677e0ddbd4c4732650ec3f3dab1300f7a910a3dc23c7b3f9f9249", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893667, "uuid": "6ed0d8e7-9e95-4988-b923-507e9ddf2c45", "comment": "Malware payload", "value": "98b1ed5cdefaf7fff94d275dacfa6bdcd6943ead", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893667, "uuid": "291dc283-6642-4766-8972-47883b537e0b", "comment": "Malware payload", "value": "e3dad3d5d2413e4067a26317fb0012128a4b396f2e0625fe5ba8cc46e56907f0ad2897225c028de4e5ed5cae008f57b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893667, "uuid": "a91ef671-df6b-4f32-bb7b-3cdc5cebcf8a", "value": "7304B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893667, "uuid": "4ede1706-312d-4710-8cb8-e3247a4f52bb", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893667, "uuid": "2f8de2da-0a54-4497-a520-1a18a663d9ba", "value": "3072:TWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:TWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893667, "uuid": "c0eaa4bf-9964-402b-9f80-9a4f3a3ad010", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893667, "uuid": "d1a6cb7c-68eb-430b-912e-49a95944eea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893667, "uuid": "fa96d3a8-7bfa-422d-ab34-a1757b97b7de", "value": "a8e7ae13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1906fd-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864890, "uuid": "3699b2eb-26a3-43ec-a621-b413bb401f1f", "comment": "Malware payload (Dridex)", "value": "f52e75966b39f0ad94945010e03bfe31", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864890, "uuid": "88e0ce26-422c-44c8-95b8-7852afbff1fa", "comment": "Malware payload (Dridex)", "value": "816da40ac522a4a41c230fec1040f3a9724e472e54f56135bf87793397c4a95e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864890, "uuid": "37a026f0-ba5e-4799-8311-995da125fbbe", "comment": "Malware payload (Dridex)", "value": "a6ce38c52de13a8b2573ae2da0e5bb2fc829a096", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864890, "uuid": "de3ffd4a-1483-4e50-b15c-29bc12869c14", "comment": "Malware payload (Dridex)", "value": "3b28d22c9b3b887fbcf59ff91ad318ded1179afbef45a256d39e57e57f1cc4f1923d0271667be2956fc46869de02a722", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864890, "uuid": "e55d19d6-43d7-4dfc-90b4-e524fa7fddee", "value": "16F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864890, "uuid": "c6f1a22f-bff1-45f7-b74e-cd3efea0fa88", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864890, "uuid": "5f7517be-b6e2-4240-9a99-a141aefdea28", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864890, "uuid": "8949c626-144f-42f5-8cbf-6bc65676a0b5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864890, "uuid": "f92c2474-72bc-4c04-8c61-b8fd678296f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864890, "uuid": "ab0ba7cf-b4d0-455a-9766-1de93757d6bd", "value": "f52e7596_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8d75ab-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861429, "uuid": "be73d465-ecd0-4224-9643-ae4441e3443a", "comment": "Malware payload (Dridex)", "value": "c13ed09ea2d98f5f2b6a5139ac08527f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861429, "uuid": "ba70246c-1c0e-452c-8fba-09de94feeafc", "comment": "Malware payload (Dridex)", "value": "81c6be281d52729e61c3a80a1649c7390d11b030c8247687945387900a61f3c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861429, "uuid": "5d783e76-d18c-44e2-8289-52e5b28f49ed", "comment": "Malware payload (Dridex)", "value": "2c7d46d289506f301b91838fbff6612e8ad17463", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861429, "uuid": "6cf51d70-26f2-4557-a0ee-74d44c4466e5", "comment": "Malware payload (Dridex)", "value": "85f4a10cd9f70c34c10b9171c6c44aa76d5b1ccd14a5d055edd61bf915778ec3659d1b2afd116efe47f344bc1d3fdb36", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861429, "uuid": "bddce02c-d9a1-4070-834f-7edc36f57a3b", "value": "27F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861429, "uuid": "897435ad-764d-4c49-8819-264243b793fd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861429, "uuid": "a13f3d1a-4f37-4658-9b6d-0350e8f88fd5", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861429, "uuid": "fea1f7ab-999d-4f51-b194-e85bde91d978", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861429, "uuid": "29627b65-b6bb-4a38-aa89-0ee74cbde96a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861429, "uuid": "3ae2ee80-70e9-4524-b3d2-731db5c815a8", "value": "c13ed09e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7aa8a5-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621875742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875742, "uuid": "93e7c9a0-0b32-4b12-bec6-17cfe231a063", "comment": "Malware payload", "value": "6da1f89fbe932940fb6d657d93963825", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875742, "uuid": "a86decd4-e4f7-4cb2-8564-076078285e4d", "comment": "Malware payload", "value": "81d7dc137049946fce2f950a285a7f3dc50e7241e5578854124c870489014a80", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875742, "uuid": "cd1de8ee-62f0-477c-b146-ce68997315e7", "comment": "Malware payload", "value": "ca8eea5ef5c4f0d8053e36f29ea2fd63c6e4f156", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875742, "uuid": "1f7806cc-c5d5-4393-a655-5518dcb4b2fb", "comment": "Malware payload", "value": "17e5186c1be730ba6fe1e7481990599a30f4f1980221758badbbbc5bd47bd5d8d272b99da3a5106e0a1aa06fa7c07f89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875742, "uuid": "ac5a5877-9120-46f4-9d30-2d64a1c3088c", "value": "68041365744447A2EDBFB950F6AF0B9AD51DAE28F07EFE0B87741A740805079B0B824F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875742, "uuid": "70152753-ac58-4b98-82b7-6f8f7ac5ff41", "value": "3072:WZyqntfdA+UwsE9phGRn6DkSNQoLXWNnCj6eRpltUOn0KUYIpkG6ydYeCdFNx:etO+dj7I6QSxSNC939bISn7FNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875742, "uuid": "92a668c1-72cd-4751-862a-0b4060be6807", "value": 176913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875742, "uuid": "b480242a-0704-460a-81a2-b30303d5ea3b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875742, "uuid": "19001aba-e190-42ae-b8e2-5580a27c45b7", "value": "6da1f89f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6856abe-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "54d53f82-db5e-415a-b8be-a3c5eee86acb", "comment": "Malware payload (Dridex)", "value": "45d8f911be25ef8f9ef935f5ec551d05", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "7e075df0-6453-4f17-bd39-f62291f5ad31", "comment": "Malware payload (Dridex)", "value": "821ff368dad7af9362258140d894da605e7b2346542dce4afc8b28da22daef2f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "042d49d5-30a9-43d1-8275-7a7aa52503e5", "comment": "Malware payload (Dridex)", "value": "89273c136223535849cdd4e7774037b3489bd3f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "4989341f-000f-4ef8-ae08-6cfb14080761", "comment": "Malware payload (Dridex)", "value": "abb0885193343678c5f599336d9d2b26d9397c6e36a3878c434b38e2f0f9659760e6e927de0f0acee2a0768e3eb3b00f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "d8354bb9-31a2-4977-a7aa-137065320a17", "value": "97F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "bb2f82f9-a317-4cd8-8ae2-7f779f874538", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "171f1b10-762c-4719-bf85-2150408addbc", "value": "3072:TIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Ec7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850469, "uuid": "01e9c461-feaf-46e9-b9a7-de5675d4fa4d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850469, "uuid": "f07db0d5-8163-453e-aeaf-80022f7f67b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "d56e4f48-1ed3-4e3d-bb89-f62be5ccabc3", "value": "45d8f911_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b6f2c6-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872830, "uuid": "27d649a0-05c8-4b42-a2bc-7adcb990ccce", "comment": "Malware payload (AgentTesla)", "value": "05ded7314dce6603077bb328df615d41", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872830, "uuid": "779c9a8a-d89a-4d1d-8333-6c15d26592df", "comment": "Malware payload (AgentTesla)", "value": "8222a6d72ea0c8cbf308030b5215108f1e4d2549fd88f7a31ef5a905e9070ae6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872830, "uuid": "247e0d5b-c32b-4b0e-9f1f-28e1c87f5cda", "comment": "Malware payload (AgentTesla)", "value": "91554ad83531f2cce79d4e249a69373853d76f5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872830, "uuid": "cb0bfa4f-513d-4356-b9a3-77a487b1ab51", "comment": "Malware payload (AgentTesla)", "value": "e13dd5451b1c61d6c5c03233fabe1501c92e40e441fbd2252cacf4ceda425a08ae7e435281e51b6caf15ebd635f4c8f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872830, "uuid": "6e9f7227-78ac-48b4-9ac0-e53d4fdfdf9d", "value": "7425261C516AF136C1E8C27946D4442BE750D73F6031AD29A8F7DF983A3BE40B98D26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872830, "uuid": "d66a74f4-a6a7-4617-8777-a6a7be071444", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872830, "uuid": "b6298e37-5020-424b-befa-9a15c601b0af", "value": "24576:LbBCe2yQXoltlAagBnjeL5w+UNWIrfG7:3BCe2yQQ7g9jel+IIrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872830, "uuid": "604dfd86-1d4b-40c2-bf2d-f88a446464f2", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872830, "uuid": "cbc89167-e1f2-4f83-9237-fdc9028e4ea0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872830, "uuid": "2c8f84e8-aab5-4122-aba8-dc181a7bf874", "value": "DHL Airway Bills Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02ebc26-bc58-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621837573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837573, "uuid": "c2efc5ba-c757-4c8a-af96-273faf5710a7", "comment": "Malware payload", "value": "b25c5b061e106240388d4490cb845eb5", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837573, "uuid": "e41a4846-82d4-4ced-823b-5b2d1448a1fa", "comment": "Malware payload", "value": "828be25b5728b443680ea58bd58ec85ff759cc5f798093b3a78c01747ca7dcff", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837573, "uuid": "ab123bff-647c-43a4-83da-d37464c26cc0", "comment": "Malware payload", "value": "a874f4b79afb1cc69aeb959df50ec41d8d8cec51", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837573, "uuid": "00575abd-953b-4699-af9e-cb71811069f1", "comment": "Malware payload", "value": "3b2726cef27b08109af41f513d6f299b00a4fd38574f7bfe6387a8d0b1d572852280d02f26a2c25253a0a465bc3d17df", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837573, "uuid": "a48787ac-f1d0-4e64-b75f-30cf3c9cbece", "value": "96E433553AD6C68A35A50E7F633FC3B648043342A8E51FDD5E013EB17A82A6683B91D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837573, "uuid": "759fb762-9b11-4d0d-99e4-8649aeffa6ca", "value": "12288:33UgeRvT0HlrGou1KHhY/7nGQEk+Uqmi9/ckUDBhjeiMwcG3Fe9UgYYO:33UV+lrGoAKBY/7BEkyUk4Bhih0FNVYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837573, "uuid": "ac67c78c-bd45-4f2f-8ad2-08f95083c21a", "value": 692200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837573, "uuid": "d8d6d40c-3565-4e19-88f3-cd596b8eb9dc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837573, "uuid": "0b3a1372-7f29-4d96-b8d6-533e0c9cf2b3", "value": "REVISED PRICES 20210322 BART56.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e09c53-bc8f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621860930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860930, "uuid": "5102d9a5-f4d7-4c5a-bd3b-46ea92bc0b97", "comment": "Malware payload (Formbook)", "value": "981455d2538ff4c051f4459e70101bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860930, "uuid": "8d0b9e4c-d39a-4f56-8eb2-e7a633c6d772", "comment": "Malware payload (Formbook)", "value": "82de7428f30e703ae55105807dd3c3c19e2f8a377e7a5c2b925537a182d3a886", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860930, "uuid": "238cd464-77d3-4afe-b60d-d0710eff6b44", "comment": "Malware payload (Formbook)", "value": "01880e3b23143d65d5e684b86f34154a53a0321e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860930, "uuid": "423f4a06-b860-4ac9-9964-d84fe0ecd99d", "comment": "Malware payload (Formbook)", "value": "0ec9b1168657c3a8c79bf53aded88cf4cc970199ddd68df91e7de90745a9fd53a6c2bcb3d4e93a034ce43dcf89608bf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860930, "uuid": "32c19a6d-e00c-43d8-ae62-9c18f601589d", "value": "743412D919CCC8ABF99707311037CB6AC6BB23241FA9108F7F550BAE6C05683D966277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860930, "uuid": "ff7002d5-9ef9-4e82-a02f-9732259aa602", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860930, "uuid": "79880ee4-75df-4fb3-8a85-76965a6c24f2", "value": "6144:8sBp2LVNyyaRSbpN2GQEijJsiKITP3mY3K40:Fp2LV0ywahgJsiHP750", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860930, "uuid": "585a3dd9-93b2-4ce1-879d-74718d9763d5", "value": 237827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860930, "uuid": "7583eae3-e203-4a62-b5bd-d52e1481d4c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860930, "uuid": "fe4e581b-2e4d-45e1-8bcc-b0f02c80f998", "value": "xx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b1eac6-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872214, "uuid": "f68aca75-0000-4a15-b17f-d47085937aa7", "comment": "Malware payload (Dridex)", "value": "31f80fd528767091eae8552e872165f8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872214, "uuid": "72ec72ed-2957-4675-baa0-a39d4624d211", "comment": "Malware payload (Dridex)", "value": "82e73550e0c87da889ae8e3db5011f71b124d82a659bf9b0cfd2e8f84ecd159c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872214, "uuid": "cee4b2b2-037a-439c-8ad6-89080490e672", "comment": "Malware payload (Dridex)", "value": "adce10f35492cbd812d080fa5e62a4f48a3e9e72", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872214, "uuid": "acbab42f-507b-44b0-998f-7f160508abf6", "comment": "Malware payload (Dridex)", "value": "f001c260efad3cfee62de6e7d253f345ec3e731dde4968f0cd5f72c10f785f89aa99653f9a00294efcc3d73349dfbd0c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872214, "uuid": "ca012c29-7718-46d5-9f5c-6fa8584a76e1", "value": "84F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872214, "uuid": "c2656c6a-fd06-4b81-86ab-912ca8c24d76", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872214, "uuid": "9d688d22-c0e9-4ca1-b155-63c7f7a93b44", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872214, "uuid": "a3c6bf52-af88-467b-9f8a-b2cf8c9bb08c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872214, "uuid": "dfa9f9c5-d39e-408d-8cc9-1f274148f332", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872214, "uuid": "4217762d-8ee7-4e0a-91ca-cec75287524c", "value": "31f80fd5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b8b92a-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868671, "uuid": "34440466-fe13-4c12-82f1-3d5e2e89a327", "comment": "Malware payload (Dridex)", "value": "2e00ebe0532b0ae0d6a2c18b04c3fb79", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868671, "uuid": "9a7fcbf2-d80e-4a3a-bb85-2f9cebf9a053", "comment": "Malware payload (Dridex)", "value": "82f45650b23018c52394fe6cd42750fc7973b96d52488bb670d3fc4de0e67b66", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868671, "uuid": "2535db83-4ceb-4c54-851f-bea0e96980bc", "comment": "Malware payload (Dridex)", "value": "598817b30d4a078f97dd1d3eeca383661719416f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868671, "uuid": "792d01ed-95d5-4269-bbab-4fd361b96dc6", "comment": "Malware payload (Dridex)", "value": "17e970bcda0995e6b0ca0fe472edc5cfe0e08b6c8cb150a06e037beb28ee20f24dc959bd7a2bf220e2ce587d03aed42f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868671, "uuid": "2ae473d8-520d-491c-a864-b5c0a3d84df3", "value": "29F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868671, "uuid": "f138da32-75ec-4b88-9d9a-d61ca8d32a20", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868671, "uuid": "509aec44-fef3-4967-8ad1-46c263a6e856", "value": "3072:KIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Dc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868671, "uuid": "e6109c24-ebbf-483c-8cfb-cadf359727ae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868671, "uuid": "330e00d1-aae3-4e36-b668-653b0694e212", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868671, "uuid": "427be40c-f02f-404e-b505-d848520bd494", "value": "2e00ebe0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c980e0-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843347, "uuid": "12a1778e-0643-493f-b653-c625a4fcd3c6", "comment": "Malware payload (Dridex)", "value": "d90d66f13eae3330763e9510d559dd1d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843347, "uuid": "621a6689-75c1-4adb-a735-9a0ef2de7b35", "comment": "Malware payload (Dridex)", "value": "833a955ad6a5fb0c736a3719b61e8967ae571187198558845e08a18db4d46eed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843347, "uuid": "1a1b9f4b-872f-47d8-91b9-c317fda84177", "comment": "Malware payload (Dridex)", "value": "90385a7240137f1ac6ff9de372b3795a05db7675", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843347, "uuid": "6b04ab07-28f9-4b08-83ec-f02773339d6e", "comment": "Malware payload (Dridex)", "value": "0c654279d80c3d9b61945867a5ccdf3624032af987bda297b24fcbf474d8ef1cd79a2de07f2231b06e8e767957f847f6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843347, "uuid": "2a20cb7e-1fd9-46b9-b505-291c2b4f5753", "value": "97F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843347, "uuid": "ba5a4a92-2204-4c9a-b57c-e067256762e2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843347, "uuid": "2dab215a-fd2f-4ba3-b5a7-c562036bbe0c", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843347, "uuid": "28aa28f7-9796-4bee-a98b-7afd013d7658", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843347, "uuid": "0fdeb2c1-742a-44c7-b68a-78f9cd7bbd60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843347, "uuid": "3fe54376-d723-4e29-9fcd-5d5f754d7c30", "value": "d90d66f1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6829ec6c-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621836057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836057, "uuid": "52b0f4f2-c8d8-4cb9-90d2-106d86c9073b", "comment": "Malware payload (NanoCore)", "value": "c1814739a255758dff213c6b210cf7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836057, "uuid": "8b5a7630-0c15-4f29-b53a-da5a72c7f1d8", "comment": "Malware payload (NanoCore)", "value": "836234d60ad10fa673a2202a74dc5ad4f7b893879f012747c80892c4faefd000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836057, "uuid": "88e6c194-6bab-4c5f-94f1-a82afa4ad874", "comment": "Malware payload (NanoCore)", "value": "7964c002a3fc33c3ceb78f8c4becf7624dfab93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836057, "uuid": "87be80a8-a472-4ba1-8cbd-71dffb7fbf65", "comment": "Malware payload (NanoCore)", "value": "76590eeb32a678cccb36cf9e7375a26d01ccc43676f95c72ce8d34c697b52f70df78244f8ff4234395a8cbb68c67836e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836057, "uuid": "c8c15feb-6336-418e-9e9b-52c3d78dc16e", "value": "26C4D06C3790759EC467DA32DD742D20A6317877932BD30B6053169DAE4EAEACE103B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836057, "uuid": "25e0526b-4b1c-41d7-9427-db547b2c212b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836057, "uuid": "47a64e50-d7f2-4fa9-853d-6a88228c3bc4", "value": "12288:uqQTILCSLtOQIO7BfQHeRwvhf97kZi8k8:uqjCSROQIOdfQ+6pflkZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836057, "uuid": "494be149-9ad2-4e0c-949d-ce4c1c62691f", "value": 555520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836057, "uuid": "bbf46de7-9d9c-4fee-8971-1e332d96470d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836057, "uuid": "ac2ed207-0281-4651-965f-0875728499b3", "value": "5U8Z6pqTlhp68RB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac6bae2-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836141, "uuid": "7c621178-34e1-430f-be8a-67b990f3c64e", "comment": "Malware payload (Dridex)", "value": "0b449133d87fbaa07feab3ff99727a36", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836141, "uuid": "e2c4e62d-2820-4287-9481-a79e7bf74c61", "comment": "Malware payload (Dridex)", "value": "8362ef1d6cba4b952d1a88484456b38e2ab05b1a048512d429e74d60c1d4b4ad", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836141, "uuid": "f1da62ef-1a6f-4fa6-8971-47f2b1a14304", "comment": "Malware payload (Dridex)", "value": "9e31aa1873a7c3eef5cc6fd6a5d15be26b098f33", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836141, "uuid": "30e1d1a0-4088-4420-945d-47559868e450", "comment": "Malware payload (Dridex)", "value": "00d38160e4a808fa90e14616d56a8ea6a1d65caa9e0238feb8424893870d63bb68198758243e7a49810967359a993adb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836141, "uuid": "504ac861-40fd-4620-81e3-25db40930768", "value": "F8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836141, "uuid": "bfdb70c5-2839-44dd-9118-99b3f0d5f149", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836141, "uuid": "75a653ec-d35c-4555-bfdb-986751d35ad8", "value": "3072:mmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:3Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836141, "uuid": "6fe26f84-a984-4093-9649-d8caddf3ec72", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836141, "uuid": "fbb71a2b-53e5-4008-a423-fd4441d7c0d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836141, "uuid": "fe9e5db3-84f6-46a9-8441-40cbc901caf7", "value": "0b449133_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a576e8-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882920, "uuid": "2d4fe93f-ab97-476f-b9ec-d32104fe5375", "comment": "Malware payload (Dridex)", "value": "b1eece37144206f6a8cfb62880ea42c2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882920, "uuid": "b5551d1e-e87f-4820-bca4-62e96ab1ebed", "comment": "Malware payload (Dridex)", "value": "8370ad43c0375b96f5335c4159ee50290950f7c03187cea21c533d7044b6a162", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882920, "uuid": "deefa274-ea08-4983-8e44-5d2927c72ded", "comment": "Malware payload (Dridex)", "value": "087c334b4a8b9c9156e1c8fc56494421444e2272", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882920, "uuid": "e9a3248a-9c5c-471a-a806-69c9b5b383e9", "comment": "Malware payload (Dridex)", "value": "4051751c82a86eb0aafa3ebe82ce7e0bd08a0b9df0580524b91f95be37f7763798467532fa3e054265fc3cfdc9aa5ceb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882920, "uuid": "60b83a73-b1a3-401e-9354-0a6134c8a53f", "value": "B6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882920, "uuid": "e936c614-cbe8-448e-a54e-4392fb8813a5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882920, "uuid": "989bcdc2-6bbb-43c4-9990-15fb9697efdf", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882920, "uuid": "6931cb21-0c9a-4191-ad19-c1fba61fa729", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882920, "uuid": "8b6421a3-b61d-4386-8179-46e640818301", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882920, "uuid": "eabecdc6-900d-444f-9f57-07a2c595c723", "value": "b1eece37_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9708768-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621867573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867573, "uuid": "8f32af64-b0e7-4136-9f59-d6ab686136d2", "comment": "Malware payload (njrat)", "value": "fc826bb76a0648b8c72a017e8d5b9878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867573, "uuid": "7ab2fe07-b28a-4d24-8136-317e27bdb6ea", "comment": "Malware payload (njrat)", "value": "83b143749cd07d13c73f8ee73136503f071cca1853921a6502d789a91fe13782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867573, "uuid": "2b9050e7-d763-4e7f-aa14-97b98ad15b03", "comment": "Malware payload (njrat)", "value": "cad963ce1dbe3926ce1277b64dd2c2aa235610b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867573, "uuid": "d877eddb-df90-43bb-9fd0-89cace912182", "comment": "Malware payload (njrat)", "value": "15b1d4fc0dc010ccd2eaeac70105fca6a8faa66ba0bb7542a5b97514c278cc4154cf475f7562f0ba9589f75d824284cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867573, "uuid": "800edc7d-e950-4c58-93ae-92eb1b64835a", "value": "13B21A4E3FB98856C5AC17748AA5965003B4D1870423EE2FCCC550CBAFB3ADA5D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867573, "uuid": "513aff1d-7ac7-4f17-ae4e-7c30aac2c3de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867573, "uuid": "0731e465-2c25-49cd-a9eb-349bf6292ccb", "value": "384:11weXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZ2ooie:1qLq411eRpcnua2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867573, "uuid": "adcc2900-1618-4186-9154-d17639bc1550", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867573, "uuid": "ff1087ba-c5e4-490e-8517-96e467855e19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867573, "uuid": "189f2388-9174-471f-9363-bebb37d35055", "value": "FC826BB76A0648B8C72A017E8D5B9878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b73958-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850493, "uuid": "8c82f291-2a6b-40d7-a7d6-ec8c1b3e1f8d", "comment": "Malware payload (Dridex)", "value": "f4aaaf941296fa118fea821bd44ee9e0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850493, "uuid": "b36414dd-a908-429a-a8d5-17171e80f796", "comment": "Malware payload (Dridex)", "value": "83b40cbf1e090f6c82fec31ed08fa1c8c8155010b1b28985b4698540228f9d7e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850493, "uuid": "b256c3f1-3a74-46fd-954b-3e1ad8681503", "comment": "Malware payload (Dridex)", "value": "cdc0b8e3c599616004578404dd0ebf671775b68f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850493, "uuid": "c4831e81-a31d-44d5-af2e-5beb1266978f", "comment": "Malware payload (Dridex)", "value": "f37efe22f371e1c57377d62b2d2edf3af2ffd142ce041b1de2dfd796d635188fcd19830704832a57f7f0fd62856cf9e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850493, "uuid": "bfe71d42-80fc-417e-83e8-2fff75a4e67e", "value": "BCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850493, "uuid": "3b0c76c3-1c54-4c80-9bb1-793b6f0a0932", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850493, "uuid": "67a8cce1-088e-4adf-8a49-d6f79ae3b075", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850493, "uuid": "00d840df-7e58-4fcf-9f75-e318fc2111a9", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850493, "uuid": "20cb71e8-296e-4683-b4e1-0f4b56e14705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850493, "uuid": "a678cc31-d4bf-468b-a90f-0e8b908c5f01", "value": "f4aaaf94_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa297fcb-bc7e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621853777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853777, "uuid": "4dd83605-fdbc-4242-a325-89dc4aafadee", "comment": "Malware payload", "value": "ef875d45049e73e438a4acdcc3ce48c1", "object_relation": "md5", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853777, "uuid": "66dfec74-7fe2-474c-a4d6-1d5ab380bb69", "comment": "Malware payload", "value": "83f7ad90826b5967335883da51a4338c6ecc02d01f74bd6edda52a9823dd23aa", "object_relation": "sha256", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853777, "uuid": "e5b166a6-b305-403a-a55a-cd2e6d76fe7a", "comment": "Malware payload", "value": "2431c472a1e35b2b7c65c2375a82f4c296eb79c5", "object_relation": "sha1", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853777, "uuid": "0b986c0e-5f41-4581-8aee-8ffc362c9461", "comment": "Malware payload", "value": "2212f74dc5058fa4d71c17227991b099e1cc186f1757e511314a0eea408d7b58bb65869e6746f53c1ca75236407daac2", "object_relation": "sha3-384", "Tag": [ { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853777, "uuid": "afa12aa5-b6b2-434d-85bd-1f5d974f1020", "value": "1E1601A1EF91590ADEB616303C30256A317AAEC69F639333071A397D6C3F4E50F866D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853777, "uuid": "575440e7-cecf-4bee-ae75-c07693725124", "value": "49152:we5daFlBbepJLxcTOwxjxmchmfMA4kEHPgtI/ce+Sun1Jh7koWD6G/XxLIXxamDE:D5sFbbeytfhLkE4tIkl51n7GjXvIly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621853777, "uuid": "9805783b-0735-4397-a2b4-614d2563ae10", "value": 4147328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621853777, "uuid": "9af41cff-0108-4cc8-8930-df78f40a1305", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853777, "uuid": "a0b52447-f60c-4005-8d04-ce8896117ecf", "value": "\ud63c\uc790\ub9cc\ubd10.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f67c4b9-bcd0-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621888924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888924, "uuid": "8a313378-51dd-40c1-b33c-c92a2b56cc75", "comment": "Malware payload (NanoCore)", "value": "50fa9eee8e12eb704ccaf81c32229d26", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888924, "uuid": "08a4cb77-e735-43e7-a0b4-87b63ed0668b", "comment": "Malware payload (NanoCore)", "value": "8447068772bed3de9c49ebbdac1c0d28a4d424685a2ed86c4bdd7d331e9b9b1e", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888924, "uuid": "4406dc6d-1953-4c5b-8732-4df69e4e7bae", "comment": "Malware payload (NanoCore)", "value": "8bfd0daff4ea15f318247c7c10f2af86e0077da0", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621888924, "uuid": "e891dbea-f7b1-4e12-a1e1-4d12d87267fc", "comment": "Malware payload (NanoCore)", "value": "9dc2eb76579b1188b26baa3786b930efa2649c8690f88a3c6f1cefefb36029a70d5dd945cc7ed664373a5e72e4fc6c43", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888924, "uuid": "bbd7dc34-b80f-4b48-a207-000eb9b9107e", "value": "F7C4D06C37A0B59FD867CE369DA42D109A20B837532BD34B6017266C5D4E6EACE107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888924, "uuid": "b02d5722-2ee1-48b5-9fff-faaf2b9cc2da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888924, "uuid": "1dc39eaa-2ed4-4131-92c7-0da96b70e094", "value": "12288:IG+JpvMPSy/zdt09pJWTgvGQbI/NV65s7Wy4QROOmXG6wD+t0gVkEEBfszua8AeH:3+aawzdtCpKyGEI76O7WrOmW6wDU0Qkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621888924, "uuid": "15a2ef57-90b7-405b-87fb-d8a07ac0db66", "value": 549888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621888924, "uuid": "635c6e9f-a840-42d2-b426-c8887e25b997", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621888924, "uuid": "4f466ab3-e72f-4d6a-b43c-d886bce5d1fc", "value": "INVs(2341).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dcb74b-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621850570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850570, "uuid": "6ec9a0d8-4693-4dc6-9c01-b6ccf1d73f0b", "comment": "Malware payload (SnakeKeylogger)", "value": "5e9fc3e8e46469128e283901ece8bfa7", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850570, "uuid": "eb4b020d-90a0-4345-bb85-cec085e1c7f4", "comment": "Malware payload (SnakeKeylogger)", "value": "84958ad9a7dac74ce2acd2474c8202e1d872e4b4a1bf73d5411e35293f177d17", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850570, "uuid": "cbba212d-ed31-420f-a8e4-9eabd7e551ec", "comment": "Malware payload (SnakeKeylogger)", "value": "7ec8d83ba5028189917f2589c410fa51a9b2fcdd", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850570, "uuid": "92ead851-ec0b-4062-a182-568a0c0eafb1", "comment": "Malware payload (SnakeKeylogger)", "value": "d47a099a374e7ca76b6b1588745db288d67bab65abaf4bdbf7cd5b5ea33965e632d1f988290b3d8c7783d5ee046c1fac", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850570, "uuid": "5c2bb483-f6ac-4f42-a6ee-75c149368037", "value": "43942357249CAA97EE4998701C0333D9D6552B8CDA97F3317209B3A1D41E93CF8CA8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850570, "uuid": "c40191d4-b117-43a5-8d0f-c00131e63d7d", "value": "6144:1AkkyzKK4pKQ0XK9zAcD0GVQUbNWbLP3hniODFHfAko4s0HzqQuN:13k+KKcKVXK9lPQUbYvPR1FY5QmZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850570, "uuid": "93f31de3-52d8-436b-b937-94b470f54256", "value": 409752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850570, "uuid": "17ae7387-0fed-417b-89d4-fa60a11755a2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850570, "uuid": "634fb93c-e32c-433a-98d7-711c17c1f921", "value": "BL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8e391d-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886451, "uuid": "74b6a387-5485-444f-ac37-3367ba9c767f", "comment": "Malware payload (Dridex)", "value": "d90512fc412a3101087410ebd083025b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886451, "uuid": "3b5966e3-b1be-442b-a19b-68cfbe42f813", "comment": "Malware payload (Dridex)", "value": "84a8ab634dce0a75a9e3c000489e41a0ecb480bd8ae6caeffad9fb7cca3fd49e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886451, "uuid": "b61d035d-002d-4057-867b-5e4080c438b8", "comment": "Malware payload (Dridex)", "value": "9a4e3a51ec97c047dde2be8ad4c795680a9278b1", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886451, "uuid": "14e8fabb-e239-43a4-8de2-e57c3b5a84ff", "comment": "Malware payload (Dridex)", "value": "fb6774073e0c5eeb940b5870dffd71dfb0dc6e3c2ed0134cd77fffa7d22bddda08bd80d2c609627478cab420aff3fa4d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886451, "uuid": "d8825043-145a-4073-a22f-c4e456186fe1", "value": "7BF3D088CBB3E4E6EFB3D37866F85E1B461174551408F4F0C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886451, "uuid": "52528ffe-675b-4663-9a21-174b76ceaf6a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886451, "uuid": "f543b149-e8a3-4089-a18f-f7744537b18e", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886451, "uuid": "adbb36a9-9e42-4ed4-aa00-6023b592361f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886451, "uuid": "ed9202dd-8bfa-400a-9537-fb66ff755646", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886451, "uuid": "36e2eed1-04d5-400f-a58a-e3a5e627a54a", "value": "d90512fc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a3beb1-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836106, "uuid": "ae6cdf51-0761-4074-bb69-c7481c937cf1", "comment": "Malware payload (Dridex)", "value": "a9087d1346d52d4c23c817d69e6620e1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836106, "uuid": "7221ac37-cfe4-4312-b888-036f9ac905eb", "comment": "Malware payload (Dridex)", "value": "8560ddb350afc1647c86a12e8fb39f662c72a37d5ae28157e61f4ef579ea1f11", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836106, "uuid": "7420580f-a815-4cd5-90b5-5ce4edbe1245", "comment": "Malware payload (Dridex)", "value": "c7e496d3946cc805ec28051f672e400f47c035ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836106, "uuid": "9328dea7-e007-406c-9905-e06087f67695", "comment": "Malware payload (Dridex)", "value": "aea95d94b1633d9953511c8ba17b61a6bde28d9d1ae48ba4aaa894578422a735afa9471a6f115b25ad36eb4794aa985f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836106, "uuid": "bd9e460b-2f70-405f-aea4-d34c7ed6547d", "value": "0DF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58FB4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836106, "uuid": "597b4bfd-9167-414b-a15a-a4fbf4118217", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836106, "uuid": "482f6aa8-361d-4712-a84e-a859ee2807fd", "value": "3072:wIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:pc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836106, "uuid": "63b930fe-a4ad-425a-b9ff-e17391aee570", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836106, "uuid": "deb36470-3a01-46b1-8d68-6928aa22c6fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836106, "uuid": "4503925e-1982-4d5a-8735-04ef66353f33", "value": "a9087d13_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d87a11c2-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872323, "uuid": "d78bbae7-0d50-4c8c-aa60-55c7d4b0daab", "comment": "Malware payload", "value": "60a4f5d13ff60673b00a0fd691cabd10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872323, "uuid": "57cc0be6-c2fa-480d-81a6-60e8852bf709", "comment": "Malware payload", "value": "85bf7b839bb957bc59af0c080017ffb3757db28765a6699861f9ef890a498356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872323, "uuid": "d99fa61b-a640-4d89-b0b7-dcd1304c3e3c", "comment": "Malware payload", "value": "70daf6f99481e20bf69274249fbe7820ef00a310", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872323, "uuid": "49dcab80-42be-4d99-af00-9fc7ab0127dc", "comment": "Malware payload", "value": "9bd9fdc3b07b58fa833214ff47f9fce4d4a4552463cfb96030d046b9cc849f016558be240f59f4a8878d8c9c306f00bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872323, "uuid": "edb38ba4-b945-457d-8fe8-ab9f545ae74b", "value": "F7540C4472FA2F86F4799BF812A36020C7F6662A286EC75F9DC365D72772F044A20D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872323, "uuid": "2d94ed9b-ef18-44dd-b0eb-3ead8d79ef7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872323, "uuid": "374ee0a2-8ded-441c-8959-452a7b0fdc62", "value": "3072:iJV1LtMXKSk7QIzH5bssgaeFkT2tAxnQ3+HzYvh6TQtvdJG0ZBdEor1jNAGOwA8H:iJ+CXVqkIAxamc6TGPBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872323, "uuid": "bef2acb8-2162-4f96-956a-92d671e3a4cb", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872323, "uuid": "23a8bb99-4324-417f-b4a2-514c672786ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872323, "uuid": "c5f0dcce-abe9-4fc7-9fd1-859b489ab1d2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141c2c91-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832480, "uuid": "4a47ccfa-34f9-45c0-ab93-c36c1392c429", "comment": "Malware payload (Dridex)", "value": "251f6b876cc3a10715d784352c1591c8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832480, "uuid": "2767b6e6-9be1-4f5b-9964-bf8cc357fc9c", "comment": "Malware payload (Dridex)", "value": "85c1bfeb4d69d11ec331cc06d1f93c626eb9acef686237e10307d09ba5af672c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832480, "uuid": "c64ae456-fe70-44fe-911e-a5c6f9895302", "comment": "Malware payload (Dridex)", "value": "8da7b8bf66a6efe1023eee6cd71fc6e97e638928", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832480, "uuid": "c13506d9-2fe2-43f4-a48f-a29cea1d4c98", "comment": "Malware payload (Dridex)", "value": "b3b7e046260f75dfed681c237d55096470393f5fc47b064a7616c0031f9b6411f9cdc890fb9b5eee66fb6c5b1b321514", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832480, "uuid": "a2d37054-3a20-41d2-9da7-c30b63b2bec5", "value": "9BF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832480, "uuid": "14daf23d-9f2d-4131-8ea9-243cc62ce680", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832480, "uuid": "096ebbd2-fe1b-440e-a710-18ed9cdfc7d6", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832480, "uuid": "cbcd3f20-00c7-4bd5-956b-6624dac8c45c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832480, "uuid": "e0e07225-921f-4fba-a898-0e56b716f307", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832480, "uuid": "3e068348-9d46-44f9-ae62-a6a4495e117f", "value": "251f6b87_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fa88c0-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846891, "uuid": "b1eb6370-d920-48db-8248-5f5200b45dd7", "comment": "Malware payload (Dridex)", "value": "655365c2746eecbbb79e8877832dbba2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846891, "uuid": "96552e7b-dece-4624-a845-ea94e03c7007", "comment": "Malware payload (Dridex)", "value": "85eb6777205d5e5f190aed76c8f76a20b861d287afafdd8b55d9d049e990fce6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846891, "uuid": "9b48eef2-0ac2-48bf-acd7-b19e8d5bfa8a", "comment": "Malware payload (Dridex)", "value": "a53940f3689bf09d9c34361b413dc43a2b4d1f9d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846891, "uuid": "07171fdf-42d6-4635-84b7-5da6870a3f11", "comment": "Malware payload (Dridex)", "value": "af21ba36fb52ce2ce25c2b6ae8423bc946c02e53cdd6cfac32fca03d0f59efac9edef3f267c96f4d0be4b59e4fcd5f25", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846891, "uuid": "27259785-cda4-4b2f-aab1-aed360489326", "value": "C5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846891, "uuid": "b5ef4a4e-a102-4705-8c2a-163714f34b56", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846891, "uuid": "944e8fec-9895-4993-a66d-c8208805c164", "value": "3072:3iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:MeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846891, "uuid": "9978f769-3120-4dc5-9758-e9dd61443cd2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846891, "uuid": "4c282b01-cf98-449b-ad97-ca6aee470352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846891, "uuid": "92def0c7-e1ac-45a9-93a3-39cb27a5ef95", "value": "655365c2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1548e1fd-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkComet)", "timestamp": 1621850520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850520, "uuid": "08c9ed88-bd3f-493c-9678-1e5fdaa8ca31", "comment": "Malware payload (DarkComet)", "value": "701fbddfd06ee81cbdd5ef856389aca8", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850520, "uuid": "a4cf80bc-6b7f-4284-bd40-085401a0b43f", "comment": "Malware payload (DarkComet)", "value": "864e6ddd9c09a95df11b80abbaa0b1a9a4fb890cb27ad21883f44853094bb0cd", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850520, "uuid": "9af980e9-79d0-4848-8514-2f39a1de24e3", "comment": "Malware payload (DarkComet)", "value": "f69315ab7caf73bd0d7ced899fdf2e619d3c474e", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850520, "uuid": "5c6649e5-9062-4ec9-a815-0dabceb3f118", "comment": "Malware payload (DarkComet)", "value": "a6aeed1182847bd7562ba84c6a24f69d99568b5976ca1a14317d739a73b224343a0626fdaaca7c2ef0e49f208a4d2424", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850520, "uuid": "edf56414-7af1-4176-93f7-c20b7c3dd853", "value": "9DA5E1F121AAC1C3F2EA8DB11FCE8970B4F539BCD8C9221D60D86B25929679414DD2FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850520, "uuid": "9c105ed7-595f-41fc-901c-22ef4649a2b7", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850520, "uuid": "0984f3a0-e845-4729-b4de-72a370d362b5", "value": "49152:onSEk9uZLpRahto+Uy7PegBiYsQMrzZ+6SEICHgsdKJcD3X:bEk9ujo4yCgZHOtnnLTdKGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850520, "uuid": "d4d7799a-4642-48e2-a63a-a93515a32511", "value": 2130432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850520, "uuid": "aa1103b5-6d47-40f1-af23-56e1bd4a7b1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850520, "uuid": "63855cea-0e5b-4829-8974-7b68b0e8c825", "value": "701fbddf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298bcc9b-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814477, "uuid": "f86bad49-6289-421d-a04b-692d0f3d3463", "comment": "Malware payload (Dridex)", "value": "7d23f81ed7aeae0f2bf87aaf4da007be", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814477, "uuid": "f29bc474-c3fb-4c59-b6f8-072847006847", "comment": "Malware payload (Dridex)", "value": "8725b802f182381736a6de53c99ead5fabbd08b60c13127c83728d5261a4350c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814477, "uuid": "91de60ad-b399-4b14-a645-be6506a7f9e9", "comment": "Malware payload (Dridex)", "value": "206be1dcebb5d0cc2ce6b30644231e825f5549f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814477, "uuid": "cc319f9e-fac4-4d98-bcbb-8bd8db450346", "comment": "Malware payload (Dridex)", "value": "6a9e992dfd083c5ccb1ad35e20863d43cb2ba1a37abef4787f224e0a3a24ad968c97b5ce3e7ed1dd698e113acc9d66e9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814477, "uuid": "8478c88a-0bcb-466e-b4c0-6d01c0b9e9fb", "value": "75F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814477, "uuid": "74633f06-2ca6-433e-bc66-9500c281b56c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814477, "uuid": "c025910a-1060-415d-9ccc-01a235f0586c", "value": "3072:SmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:DLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814477, "uuid": "c9d9208d-673a-4f84-8e09-0c3732d39243", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814477, "uuid": "75906fc2-00a3-4478-af13-ad593262c845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814477, "uuid": "8ed3b7fb-7b1b-4a6d-86c6-e593444271d0", "value": "7d23f81e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40a0e4a-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857766, "uuid": "5c9fe82b-ae8b-4096-99b9-94e28d12dada", "comment": "Malware payload (Dridex)", "value": "7e7d2beca09f11e9d3b359cc497d8576", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857766, "uuid": "e9b78352-3f14-41e6-8b27-3654c138d6aa", "comment": "Malware payload (Dridex)", "value": "87451a945aa8ee72cba12af0d219edc49d03412e072ce85ae643d6d39642c1b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857766, "uuid": "6702195f-d252-4840-873c-c9caadf2c4af", "comment": "Malware payload (Dridex)", "value": "c44197875684797fbb84e92c310ae2c202f40d3d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857766, "uuid": "7966c16e-2afb-4259-82b4-aa0476e171ec", "comment": "Malware payload (Dridex)", "value": "b9dfccc0282e0080420fecdde04b6c26087a76a0592bbd37e05065a5d1167195fdf2dbff71ce64332bbc295b0fde783f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857766, "uuid": "a9b75cd7-69a6-47ea-98dd-58fda3f1ec02", "value": "CDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857766, "uuid": "9d3c3d6b-ba9a-45a6-8758-48869bbd36b2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857766, "uuid": "00b04c4b-68fd-45db-9b60-3e81924fc15e", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857766, "uuid": "29c22053-eb39-4b0c-8f50-1bf6bdfe471e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857766, "uuid": "530c7866-a2ae-4932-a625-c49bf86a7d66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857766, "uuid": "7825a60d-ea92-436b-85f2-a9329d88f16c", "value": "7e7d2bec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a443d0f6-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875671, "uuid": "311a46bf-151b-4bc7-b137-5b4e845360a8", "comment": "Malware payload (Dridex)", "value": "13a3814725651476e74178bb94a634a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875671, "uuid": "e7dece6e-2be5-419e-a4b2-44a710da7263", "comment": "Malware payload (Dridex)", "value": "875cff2282d3820bda98eb97173d3d7de9f59f1a69bf38b0e2cfcc17158e270a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875671, "uuid": "d007124c-2f10-4c77-ac01-9754af9ffab3", "comment": "Malware payload (Dridex)", "value": "9e2891306a13e149651feba23e9219a1afcf63fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875671, "uuid": "848ab488-97f8-47a3-a175-0cedd0e52f51", "comment": "Malware payload (Dridex)", "value": "e9753ca693b95ec348be3fdf6c04123dfacc54d68a6f3626cd37c40de7de28058dcb04d6c04b399ba324960c0f5a665e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875671, "uuid": "1d42310e-66a3-4dd2-9ef7-1327462c0721", "value": "1AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875671, "uuid": "aa53a95a-4980-4c9d-a528-fa64288147dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875671, "uuid": "a98b0328-ca4b-4a6e-8f67-acae208dc678", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875671, "uuid": "f6521441-551f-4e89-820a-fb6b31fffd1d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875671, "uuid": "dfbc9729-4b31-48a0-8b85-eb0f467427a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875671, "uuid": "f70491b2-e515-4fad-9907-b5abcf08c001", "value": "13a38147_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7339e0a-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857745, "uuid": "66a69634-10a9-4559-8624-01858f2184bb", "comment": "Malware payload (Dridex)", "value": "d55c0b150f5e99ff2ba6ebaf88e98606", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857745, "uuid": "1cb1e693-3b29-43c8-92b9-43de36c27872", "comment": "Malware payload (Dridex)", "value": "877d37e1697b62d0b4aa3b07b4b5b27b4b56f2cb7a22cd00abe4843ab0fc4d27", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857745, "uuid": "25a932e7-b471-4b86-880e-fc921b4a5fb8", "comment": "Malware payload (Dridex)", "value": "2b93a7e2c8b8c1216114d650e53839b65383fa32", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857745, "uuid": "8759fa5d-eb79-430e-bb59-c5bb571922de", "comment": "Malware payload (Dridex)", "value": "24ff24f9daa9140497ecc610b97aac8e110bb0ebda75bd67d82f3285276098867a9c641f204eb3e4e919ddc387a9cbd8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857745, "uuid": "03941557-3397-4b7e-a422-e723ea8d756c", "value": "A9F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857745, "uuid": "24d02cc9-dde7-4af6-ad20-7625f83f5470", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857745, "uuid": "ca6f17da-9648-4666-9728-8696a570d4dd", "value": "3072:7lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:7lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857745, "uuid": "a8caea9a-7765-4d51-91fc-749f73e0d4d3", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857745, "uuid": "0d799434-e76e-44a0-ab08-5eab8139722c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857745, "uuid": "99daecb5-d0c4-4889-b166-501e7010d288", "value": "d55c0b15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc7e5cf-bcac-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621873566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873566, "uuid": "4a05c763-e976-4ced-930b-593a1a684327", "comment": "Malware payload", "value": "37cfde2efd9bd235efe9396c214677e7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873566, "uuid": "a9746d2d-5df3-4319-844b-9e5ddd8695b3", "comment": "Malware payload", "value": "8791450f70d18cddb42dc60046ad4ff94a9e1f0a9be28d88bd541d4208df2070", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873566, "uuid": "4704f05d-318a-47a1-aa45-2dc438b7e7be", "comment": "Malware payload", "value": "aefa2790a453a891ebe493bb5a4c1ae496582f8f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873566, "uuid": "a81cf290-bc09-450c-b25a-3c61e29380da", "comment": "Malware payload", "value": "aefda435eaf3bc8db8e5c23955eefa43c302c08cf4e889c58f63d56ada790a9f38235d1ca30837d57bf4ba8a546cf716", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621873566, "uuid": "764f0b40-a605-455d-8cf2-dbbcc80572c3", "value": "62E4E123B6E062D9C6799674DD26EA7063132EA46440F66FB2D4FCDB397D3330466883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621873566, "uuid": "3166fbbd-a852-466d-a5a6-9b1677d34f6b", "value": "12288:zg3yiWa4Uo56pgxDwjcz2K9PPU91xvDvUOL+nzg++++4+++++++0+++++++D:83yiWa4z5IgxDCi2K9HUNjA8++++4++g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621873566, "uuid": "f187bcec-18c7-46cc-b0c2-384d43980e46", "value": 706862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621873566, "uuid": "d82a9630-14d6-4638-8f21-aebb0cf129bb", "value": "application/x-ms-wim", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621873566, "uuid": "2e2a339a-695c-413b-836e-a4d6e7242a1d", "value": "DHL_Ningbo - Invoices - Past Due.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f8041-bcae-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621874388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874388, "uuid": "1b387f6e-797b-441b-846b-edaa799cecfc", "comment": "Malware payload (AgentTesla)", "value": "0f8ebaec9a18622d66312f00a590df8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874388, "uuid": "a1c07b24-c886-4cf0-b1c6-24785a33452f", "comment": "Malware payload (AgentTesla)", "value": "879a41e8c5e17f41545e9f057be592d335a5dfd6dbd980a16e3a25e0972f45a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874388, "uuid": "c9369fe1-ed39-4603-904b-143281765abc", "comment": "Malware payload (AgentTesla)", "value": "5cdee11f0b28b459cfaacf1eba6a0fa5a33067af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621874388, "uuid": "b6f9e4ce-d27e-473f-a0e2-146e582f41ff", "comment": "Malware payload (AgentTesla)", "value": "f691b081bb7696ad5b0fcc659e15ed41b975dee8a15937fb5b94123667094aafb4f67892113b74837dc8ba5531908753", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874388, "uuid": "42c2488e-3bff-4234-b74f-d7739c36a60f", "value": "E991C535667D0823CD0982DAE17EFEAA06D3F110A8CF1A9C302DDDF12B56769D669045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874388, "uuid": "6013f013-bb1c-4d38-9dce-7f8e48aae6c2", "value": "96:cZZ+inxqlaFRxSPBePaTlsPgs1iYdzJSf+2DWtxL+l:iwixqlapS5eP2snlhql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621874388, "uuid": "a99a13ca-0dce-45a1-94d6-30b4194a8768", "value": 4405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621874388, "uuid": "7a4f3946-be45-4444-b454-b75e826de42e", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621874388, "uuid": "b5a7b8c2-17a0-4733-9ff2-84c717866c57", "value": "RFQ97868.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f2a5e6-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621857774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857774, "uuid": "948be055-1bf5-45a1-a0a6-d25c991fca6b", "comment": "Malware payload (AgentTesla)", "value": "8cf8f1bdb47b4e4645953a9a741f3ace", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857774, "uuid": "f4d03075-834a-4cae-9033-114d63c4021b", "comment": "Malware payload (AgentTesla)", "value": "87e608472d27e2577ab901b0dd1b83038bde3d6de7cc075a0d68814f848caaeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857774, "uuid": "a9514395-ad8e-4073-ab51-506cefa9ab1e", "comment": "Malware payload (AgentTesla)", "value": "a5d5bfed4a78147303b6ff73f9846547bcfdc7cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857774, "uuid": "09669bb8-cd0f-4eb5-9b68-74bdbe217c6e", "comment": "Malware payload (AgentTesla)", "value": "c6303b96ccd4c6f312014389dbe5af08154ed12d2bacf6cea6caeeee9ae9f5aa799ac7e9c1aa22c7f44ec537d9850f5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857774, "uuid": "94d5d1e2-13ef-4fb4-9fcf-2d635c029724", "value": "DA34592C6854FE26D1A3C1B8CCC1F5FBE4945F0625211B8F8B93BF67753712A69A00AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857774, "uuid": "03ef84fc-1bbb-4cb0-be3f-fe98f7f47d94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857774, "uuid": "d11bdb5c-56b6-4c9e-8efc-2a67b698593f", "value": "6144:cjXQhf/888tFyBtB6Ux3pfiDlQfJaBmcFAlQImZB+grQIvc7n8dQSOALR3bAIAYK:L/O2yBPr2X8II", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857774, "uuid": "756ed6bd-a549-44bc-983c-db2b3a2373f7", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857774, "uuid": "989bbf88-e8af-416e-b979-394708ad9d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857774, "uuid": "030ad4ad-1be8-4393-8299-20d5e4276c6a", "value": "8cf8f1bd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9b9f99-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818052, "uuid": "3ab02571-0a78-4634-9079-9d9a1b712b9f", "comment": "Malware payload (Dridex)", "value": "261f258849e96bc1c6a8656722e3ee45", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818052, "uuid": "4fe225c4-3bf2-4364-b7cd-263b6717b6a6", "comment": "Malware payload (Dridex)", "value": "883d065e815e24dc5822fd0b614a3b1e609c66253c5d5a1adef368ab29fde849", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818052, "uuid": "f33bfd5e-6836-4aab-ad3c-e7755c6e1529", "comment": "Malware payload (Dridex)", "value": "d2b9f845c92a06b2a750d41a28ff6f2894cbadf0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818052, "uuid": "fc732862-cd71-4371-8282-876906349b64", "comment": "Malware payload (Dridex)", "value": "d5c0907cf3ff3dc8f68bebaae47899ce0102b75b41b225f2a79a511316ff8d255d3bc40cf8d74ececdf6363938ee0dbf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818052, "uuid": "fb3934be-c64e-4a6a-b0f2-84c05a39c509", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818052, "uuid": "c813880c-bc8b-4f5a-8fdf-6a9ec7bcf3dd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818052, "uuid": "af2ee13b-9db5-4d42-b2c7-1b823dbefa12", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818052, "uuid": "ebf0e31a-f1eb-426a-ad32-2cf1bcbb795f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818052, "uuid": "ab6fa8a0-aa3f-40ce-bc8d-33fa3ea0c0b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818052, "uuid": "238fa0a3-3452-4338-ba14-3262b9e6ebc9", "value": "261f2588_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2152ce-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621867636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867636, "uuid": "38448319-dee2-4526-b783-7f4c8c2588a3", "comment": "Malware payload", "value": "63b3e654d0a4baabb43fc1567118dbed", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867636, "uuid": "f1cec984-a2e6-47f0-be52-e8eaf617f2f7", "comment": "Malware payload", "value": "88e3a8474ce8258d93467774ad82fb237d2c88e9ca091dfa90e57af1e2ccbf23", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867636, "uuid": "918ebe9b-f41e-4601-9a3e-bc090415189e", "comment": "Malware payload", "value": "53376c18c579c1f65d2c913d1a96e4f357fdccef", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867636, "uuid": "de5ac1f6-c445-49ac-afa0-9c08c1660ed1", "comment": "Malware payload", "value": "7884db94a79f21391c786572ead9f3de64f975f33bbc3be99db4125467fdd7cdbeabe5921cea50b292e15c60a844fbb5", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867636, "uuid": "321c432d-1d10-4029-ae1f-2311fbf37b3b", "value": "3CA4235A9443EADB7EDADF82C248D8F5623D9B4FB4875F20D599C03E603C708D8167A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867636, "uuid": "a66430cf-797c-44a7-b326-32c359bfe949", "value": "12288:iHCm8z7bDrhJcF7UgDuoLu120jreQpHX4D8v6R0lXE:i38zHhJctDo120jBSu6R0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867636, "uuid": "2baeed07-c717-45a6-b994-9a0f8a20ce00", "value": 478627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867636, "uuid": "08f8b91b-cd4e-4eaf-83dd-9646ea890bb5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867636, "uuid": "12944813-5802-451a-af7a-23e0ec5d92ff", "value": "RFQ MLK #656577.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69e78c4-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875675, "uuid": "810b5efc-305b-49e8-a3f6-8e80641acf12", "comment": "Malware payload (Dridex)", "value": "56286edec8dfba3b1b4712fd32951a0e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875675, "uuid": "ae1e8305-5350-4c70-b426-723f1cef8e5b", "comment": "Malware payload (Dridex)", "value": "893be6b738295c5a94ff6d0f070b51b0cf82b70f955ad066401c66150030583c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875675, "uuid": "a54e4f14-e081-4773-873b-bd98aa59d436", "comment": "Malware payload (Dridex)", "value": "cc5072184a17c014c74c485df1de4ff9ce6c6248", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875675, "uuid": "4353b3ca-82ad-4fb7-969c-d043c94db08f", "comment": "Malware payload (Dridex)", "value": "d20b2b5039d817bfa89694435e5fab7da559a13e10dbdffb7d081bfb90618730057ee216f620b243fbe50270b3454471", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875675, "uuid": "d2322e10-42e8-4641-8b90-ef65b0768d13", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875675, "uuid": "cf5bd106-f2c3-4683-86a1-0fac8011b041", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875675, "uuid": "15e9754e-2b56-4e15-a974-fd4f7bdcd5f6", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875675, "uuid": "582f94ce-a5ae-413f-972a-22064076d58b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875675, "uuid": "61826d06-b7fe-4fd8-a23e-b60b7e698419", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875675, "uuid": "70b11621-e218-4a7b-a640-151595d87887", "value": "56286ede_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f2c863-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621837957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837957, "uuid": "fdfdd51b-0576-4ee6-a1c3-41f108497f75", "comment": "Malware payload (AgentTesla)", "value": "3fe0779f1438fb14d04642d9318d07d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837957, "uuid": "69728518-0747-41d9-82cf-1067a4bd3f62", "comment": "Malware payload (AgentTesla)", "value": "895d054412bf0e94dfd32276c9d9eb45e0035c464833fb6d0d3dbb7f3a7aaea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837957, "uuid": "67ad6c11-6b2a-451f-925f-cfbb2cecfc78", "comment": "Malware payload (AgentTesla)", "value": "3826ce79b002a641ea4ea3370ddf0309d439f9ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837957, "uuid": "2058eb43-26d8-4695-a603-dc958d2a699d", "comment": "Malware payload (AgentTesla)", "value": "18e4f9af79b21926ac59a681a5891628b28d0e3459afab471cb15774f63f315d8ee0bc0123a136a96cfe2c70bce8234a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837957, "uuid": "f69620ab-59a6-4aa9-9733-1c9e6b653b2b", "value": "FFE423845FF3EE20DE4C3922C1735707C217A210A923D3A773A58E1919B799EC466DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837957, "uuid": "91b8b3b0-644f-4a35-bee8-2161811e67c3", "value": "12288:3AcAIXspogw3LtwD+cvgSWNuBY2Wz6ZkfpRrix460h0JrniiUyC:3A37OtY9g6BYPzokfDrm7i0Jri17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837957, "uuid": "cfe79f46-e150-41a3-ad24-07abc623fe19", "value": 716842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837957, "uuid": "1d3c2ffd-e120-4ce7-a4e9-0de415f6498c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837957, "uuid": "5e74b487-d835-4a32-8e79-971df83ff456", "value": "T.HALK BANKASI A.S.Hesap Ekstresi.PDF!.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cdfded-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621838386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838386, "uuid": "0032aa1b-8474-428e-b466-9a1135701be3", "comment": "Malware payload (RemcosRAT)", "value": "e80504ea47b51f754382274955c7b2c0", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838386, "uuid": "db149d7d-dc0d-4233-83ba-523c3d1b84b3", "comment": "Malware payload (RemcosRAT)", "value": "898801b1f5e565994f6c369264bca1bdfdbb210794448131fb0dc5092bffa0bf", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838386, "uuid": "9243ca91-6e85-41e0-91a7-80993430f61c", "comment": "Malware payload (RemcosRAT)", "value": "b67cc211b2b3d7d6422b3d6cf0b2a0862f955988", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838386, "uuid": "ddafae58-112e-4f68-9513-a88bd9228572", "comment": "Malware payload (RemcosRAT)", "value": "e007924f8dcfded8f5fc3188a303f6ae735d33b51092a2fac142efb5334373c511c788cc335c326b76e48f17b6ba3241", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838386, "uuid": "1183bf40-e732-4161-8d83-7b5078b62378", "value": "319423E4ADE65B4B16A3D444345C9204E90B94C59B86F42D4BCDB06FCFBA8EE7DE3210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838386, "uuid": "f2356588-84a8-4be8-8217-e1f3500d409b", "value": "12288:fZItm+a9rIQaSKA+B8PvA+yUb5Vt4Ds9t4iJZ+ALDHlsUivt5:BxZ99X8i/t/PJZ+gDHGt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838386, "uuid": "e6b5bcdb-1375-4d59-94bc-ddcb68b00fac", "value": 432556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838386, "uuid": "475a53bf-f53e-4137-a3f4-b4230c3db2ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838386, "uuid": "22e620f5-2996-4c67-812c-98e1f2d10746", "value": "INVOICE NO 070FT06.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575e0c57-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872536, "uuid": "5ed9d433-ffb8-497e-8017-6cb87195e6b5", "comment": "Malware payload (Formbook)", "value": "e5a777b2006436160c4427612f2dc9fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872536, "uuid": "47528b36-d1e0-4f5b-978e-c56b7aaea4a4", "comment": "Malware payload (Formbook)", "value": "8991d5030b4541ecb6d1f0c14cb82914e745e77500f0d276b761d5e857aea943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872536, "uuid": "49c36b3e-e6f9-466b-84c9-b1bf81a3e5c5", "comment": "Malware payload (Formbook)", "value": "7c352fdd1b235f2c7dd1e20092e19d1b479fd175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872536, "uuid": "3c82283c-36cd-4c6c-a645-12c374175726", "comment": "Malware payload (Formbook)", "value": "7998026ed316d3b44ed586be27b018fd5b6a5758279db76c9c5460f114bbb18db8c2dff3839e8ffcd97d27c3cbb9e756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872536, "uuid": "786ca3d2-2eed-41a6-9779-c97b0abf4437", "value": "D6059D2C116EF126C2A9C37D4AD4442BE590D7377132FE29ECD717985B29E80BD8227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872536, "uuid": "f957df31-7a5f-4ce2-baf9-1d47feb083a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872536, "uuid": "3aa74a7a-dc31-440b-9b10-28cde6cb3b1f", "value": "24576:/BCnF94D/Ey7r9rE077KpX4m7U+naFLim+84H:/BCnb4LRCQyXJnSfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872536, "uuid": "619a2c68-a467-4e3c-b0c6-3e7057b176bf", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872536, "uuid": "fdfdc2da-c296-4124-813f-7e46da1b34a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872536, "uuid": "f4b801c6-c518-4be2-8520-058047c0bdd4", "value": "CamScanner 24.05.2021 10.01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464ea191-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870360, "uuid": "c0db747e-6db4-40e4-ab28-e476107c8c9c", "comment": "Malware payload", "value": "f3dc04eb0f9083e3d0bf9c202686b88f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870360, "uuid": "1485ea13-0732-4376-9364-a48be27d10d3", "comment": "Malware payload", "value": "89c9314a35cc047ce82b3a1b305848d8cacb510885dc3eca9a45ab73e099c4d9", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870360, "uuid": "9f7f9bcf-98e8-4629-9a8f-87edd9ee40c7", "comment": "Malware payload", "value": "afa86c25109f039a643e08e8c22d7630973bf5f2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870360, "uuid": "ead9943d-4ab1-46c1-b9ae-e3998a42c505", "comment": "Malware payload", "value": "21249cf7f6a9e08bdfd4dfea7bc1393b3c268ea7a7169d9c5c463411303799c827aa5d896aa0544af1f8846ea8039e65", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870360, "uuid": "ebb6a89d-597c-4062-9b5b-9b80bb51ab62", "value": "549423FE9F74F541F16A1F7A5887ACA38E16A0C29AC3C178FB784A499A7F85C34C1441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870360, "uuid": "34edfbb9-4740-4f62-8f34-6a297b6e71d9", "value": "12288:FIfz9r8kpJzxq3yYpqOPf382ua+r5n2BRHTWHm6XLqhTaWxep:6fl8kpJNqfqLvr5nMRHTWrb6Tfsp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870360, "uuid": "6ab15f44-7f87-4b9d-a42e-efd2fca5a6c5", "value": 432217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870360, "uuid": "0f8bae19-9818-4e97-a739-de3aa570cfd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870360, "uuid": "4bde1def-6bef-4971-b515-1dca90e77562", "value": "Pago May_Adjust_0994 PDF.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ac5203-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882871, "uuid": "98d5e65b-035c-4f18-a767-67f57ea7aa94", "comment": "Malware payload (Dridex)", "value": "7b1447ba179032b3a6fe3045c1c89e47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882871, "uuid": "65961261-faf3-4380-bc33-ac64a88b6768", "comment": "Malware payload (Dridex)", "value": "8a0eede29b05f8b50688dc909dfed9ebcf0ba40c34ce20be77fb7e03f84af049", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882871, "uuid": "aa0d5bca-8ccf-4272-a4d5-47ee693e9949", "comment": "Malware payload (Dridex)", "value": "81bc25c3ac1c23661df262ebba18d8cb18ca2303", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882871, "uuid": "977f886a-5d3f-4564-90bf-90e16d9b10d2", "comment": "Malware payload (Dridex)", "value": "a73f3217e6fd88761f9037abbf4ae1d2e94b5b8b5e4c92903d4aa00e4830704a38728edd5f106d45b0559662ebe56ee0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882871, "uuid": "c26f1135-863b-4fb0-8311-08f92c0c16ca", "value": "70F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882871, "uuid": "dd87afaa-404d-4cc6-8e98-72be2e81b623", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882871, "uuid": "bc3774b4-93b1-4ac6-966b-f7d989d29e19", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882871, "uuid": "6c93ebdd-acda-470b-a1b1-10ed8a64ba16", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882871, "uuid": "c1423217-895c-4d48-8855-1fe66afbfdd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882871, "uuid": "900676a2-1fe5-43f8-80f8-6c030308962a", "value": "7b1447ba_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7120a745-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621882887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882887, "uuid": "b20db8f1-819a-4a86-be73-21afebb2bd11", "comment": "Malware payload (TrickBot)", "value": "63fe20d59154b2a93c97f748aa49de45", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882887, "uuid": "18d0dacc-c46a-4dd3-a342-23ce117ef3ca", "comment": "Malware payload (TrickBot)", "value": "8a4235447879bb4d7f2366158d892f29a5d9a06203ae71b7ae6bd563889f1de2", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882887, "uuid": "b7a76b96-63f4-4d76-884d-f4b7712b13a8", "comment": "Malware payload (TrickBot)", "value": "4acef302681712b4d0ea79a5af11df45ea40ca15", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882887, "uuid": "0b310786-4a69-4d18-9df5-31a22c4dff46", "comment": "Malware payload (TrickBot)", "value": "408c5db4b7e263d2367bc19253085cb2038a770dedb3b968a284000e89868aebb466392dca36036bb330b4e223a9e61a", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882887, "uuid": "41540c32-4ef1-4eb6-b0cc-8cb9a72b3bc0", "value": "FF0402EDAA91E525E7A408F3C4405B831C771FC747876C6A7B12628477B0AF742C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882887, "uuid": "63f1f767-2ce4-4fd9-b430-44317bddc0f6", "value": "3072:GRevjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHzX:uov8cKSsYodBXC0YnW49MarG19TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882887, "uuid": "f401dbdd-1e22-44e2-823d-e6f7026cce24", "value": 187789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882887, "uuid": "6b9b3046-d189-48e0-a09e-5876cfff195c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882887, "uuid": "f5ea0cef-5f62-47cb-b713-f73a9d02ad79", "value": "63fe20d5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3cb57d-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850480, "uuid": "263d4983-5e46-4d0f-b6c3-86c8912bdf30", "comment": "Malware payload (Dridex)", "value": "f46ea6145c290e56d6ef0942ef319c08", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850480, "uuid": "346cabc3-da8f-4ad4-90ce-c0d968725b50", "comment": "Malware payload (Dridex)", "value": "8a8c0543ca19a4c8f6154dd8d486ede5a615b90c3f27814e8e3d28ec837c7a81", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850480, "uuid": "7f23c836-6084-4828-bbd6-a3b03c2cd579", "comment": "Malware payload (Dridex)", "value": "6ed7648f0765ae1cbcf769e5ec69b72e5f754e7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850480, "uuid": "da0db77d-dccf-4eda-99d0-f11f9264799b", "comment": "Malware payload (Dridex)", "value": "8a86c02695ad1462b43c88c14a818856a5e2e1e7d5d3c7a6846b03e3ce3c66bad726156c5b8c0a095c2881774fdc35f9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850480, "uuid": "f437ab7f-5669-43ac-abe9-2683453f3a94", "value": "5304E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850480, "uuid": "19243560-bb08-45fc-a64a-559bc97f3d64", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850480, "uuid": "bc1ff6f9-049d-4865-96a5-783e6b69a1c1", "value": "3072:0V/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:0V/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850480, "uuid": "29c656d2-d475-4606-b135-d4bf1ce90ab2", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850480, "uuid": "78c2d99d-6038-481f-83d2-7ad6a13c3307", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850480, "uuid": "3787b739-d236-4c27-bdb6-bc7f369321b1", "value": "f46ea614_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5beda1-bc6f-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621847447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621847447, "uuid": "9ff4dbee-2871-4a2d-b9e5-012cc7e1beef", "comment": "Malware payload (NanoCore)", "value": "2436bdf8de1ef22ff76c92943da72616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621847447, "uuid": "012d1e9d-ae1c-4bf5-8f89-bc1dbdba7ab3", "comment": "Malware payload (NanoCore)", "value": "8b037aca37b4d5268aa1fcbe1de2abd87f62bafcc2d7f21f8d9d6d2034e2b438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621847447, "uuid": "3a26c813-fc2c-4557-a319-59d4934da194", "comment": "Malware payload (NanoCore)", "value": "24e24b3efcbc07761d55e4dc952eed8e9ea11258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621847447, "uuid": "f013b45b-eda8-41f2-90bd-7b6faf9d6202", "comment": "Malware payload (NanoCore)", "value": "bb49e531bbd8c42321a8a0b10b9c77da808e5e1568aa220b0cc42db5953e01d9eb71bad45bcf7f7c7e9a7a4bd05c9632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621847447, "uuid": "6123196e-b210-423f-a36b-477f9460993f", "value": "12C4D0AD37A4759EC467DA72CEB41D10DA207467A32BD30B901716AC9D0E6DACF207F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621847447, "uuid": "e7e4d5aa-4e84-455c-86cb-118e9b4d4dcb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621847447, "uuid": "149bab71-9f4b-465a-904d-b57c0c5ad090", "value": "12288:ZkO9gfUBQETWmGj8nhXdtVj7o2m8oq7lduhNjH1Ur1Ut9lD:Zx9gfmXWmGgldtVjsD8oM7u7jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621847447, "uuid": "84747bd4-2e0f-4ca1-98cd-d5b48f434bc3", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621847447, "uuid": "4e0ad28c-4f3b-4171-806a-2498c1d07788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621847447, "uuid": "5a4fbf7d-b5e4-4e9e-8dab-b3e2ebb0328b", "value": "PROOF OF PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ece0fc-bc44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621828859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828859, "uuid": "972aa070-f237-4be8-8194-c41f0bfde903", "comment": "Malware payload (Dridex)", "value": "c951097ea1b76f8a4c4a853b42f15e32", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828859, "uuid": "649489a7-3aba-4ba9-8a16-8070d5b8e88c", "comment": "Malware payload (Dridex)", "value": "8bad19447dd7ab66ea924c12e3faacffd51afe8cefedea4a749970af9c433871", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828859, "uuid": "225535e9-f022-48d4-8ee0-08abc067245a", "comment": "Malware payload (Dridex)", "value": "50282b4fc0855e623b77029e914e8edd0ad136f3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828859, "uuid": "0e637e88-efc1-4c7d-9c47-5aa139ad95b7", "comment": "Malware payload (Dridex)", "value": "9bc0012cc693183590177cb9f9b644bcb7967204c72277d361330e55409bf4253c3881c904d8acb7b99a70d60568beb0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828859, "uuid": "9625abb4-5838-428d-b4ca-8104e0cf416a", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828859, "uuid": "d134fc73-10b2-4a5f-9139-5b387d24c434", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828859, "uuid": "b9078ec8-a32f-4a52-bb81-9765093b49e0", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621828859, "uuid": "9a68f7f6-bd6e-424c-9bca-991ec9ca450f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621828859, "uuid": "02332a8e-9753-424a-af35-35601a91ee4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828859, "uuid": "1e621df7-334b-4e73-9878-5143c3e53bd3", "value": "c951097e_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538559a6-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Gozi)", "timestamp": 1621861362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861362, "uuid": "d608b5dc-5982-478d-8eb3-cbde5727e5f9", "comment": "Malware payload (Gozi)", "value": "e0fadace589d24c21a74f612d35fa95a", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861362, "uuid": "8484cecc-6810-41b2-a8fb-7494484eb2f1", "comment": "Malware payload (Gozi)", "value": "8c720142f007b80afa0f261ee887411b54043dfc3b6d1d45e61214f60e314d5a", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861362, "uuid": "2f1411c7-e181-4a10-89e2-a8efd75aece7", "comment": "Malware payload (Gozi)", "value": "5a6a94a82b3f16fbca3c07327194e5689b8bfa46", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861362, "uuid": "9dd7eef0-f95b-4c0b-895a-a1d5f8e3606f", "comment": "Malware payload (Gozi)", "value": "fd7d2612d737765cfb3ab177e4cfc252cf0d2fb1576adc8dbbc72d0328c8f7a3516d37cceba1a3bd3584b03cca28507c", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861362, "uuid": "50c9a6f7-3d73-4e65-aa62-726ca89b6949", "value": "98A31251EA0D78C981F3EDF114D35314C74A37AC0E43278AF92BA2D44AB47ED9E16B81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861362, "uuid": "fae35c74-ba80-4330-bbf6-777a8f4a3a21", "value": "1536:zeImPV3N29OXzy73Glz4URCYrzh/+Uvj7EvpTwm+wK6VAYXw0oYxVyY5yZ8jdr:q1dXzs2R4U5rVdvgpL+qXTRxV/5w8jdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861362, "uuid": "24140090-49a6-438a-ad63-eaaef4adf0dc", "value": 97762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861362, "uuid": "94d9795d-1ac1-4b71-97f5-443b92a0416b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861362, "uuid": "3797ffd7-dee4-4b86-9cf6-6b96bedf8994", "value": "e0fadace_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c47b8ee-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843284, "uuid": "eb9acf16-e195-4c95-a1c9-ba6331f44153", "comment": "Malware payload (Dridex)", "value": "337a9eaf115a91163f7b05ba7cfd83c7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843284, "uuid": "b0a144b0-b85a-4883-aba4-9fb64184ba6a", "comment": "Malware payload (Dridex)", "value": "8c8779a7f37b88bcc16ce0daf6892eddad012b8690680c7b245f5e74ebd66985", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843284, "uuid": "08319800-6a24-437c-88e7-c3a70b7575ef", "comment": "Malware payload (Dridex)", "value": "b448b89a6713d0ff8ad917375726396aca6b8f83", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843284, "uuid": "429b240f-6aae-4037-a95d-c6fb78cea5cb", "comment": "Malware payload (Dridex)", "value": "11bff9abbe4979e706a4ac4ad7a9e8f4fe9f0d1bc5b9a4936084578ea6db850a0a17f33ad2d634dde84f68a02ee4ec3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843284, "uuid": "f005f602-27e2-4f6b-ad26-8121b4899db7", "value": "A1F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843284, "uuid": "e17555a0-5d76-4ea3-8bbc-7ea2d2cf0333", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843284, "uuid": "2d23fb84-5829-470f-9f9f-e538f0197c5c", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843284, "uuid": "27a4d91c-4627-4033-bddc-5e0c21ab59ea", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843284, "uuid": "e7255b08-6b2b-4cd3-97e6-b6248c965f05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843284, "uuid": "88e12dc2-779b-4a77-b72e-9d9df135d337", "value": "337a9eaf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125ceba5-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814438, "uuid": "019a4580-a371-4456-9de4-8c3141a8ced6", "comment": "Malware payload (Dridex)", "value": "799500b59412d803965e6efcbadd02aa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814438, "uuid": "8472ce05-7aa8-475d-8989-8f34920606bc", "comment": "Malware payload (Dridex)", "value": "8d1c7917ad6b1335fed466ac6cb5034bd5c9463b80834b38f00ebd26d706b7e1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814438, "uuid": "8fac0702-4960-48e5-b45a-73497329d084", "comment": "Malware payload (Dridex)", "value": "7e0ebcae4587647a8735f5210762db48cf6ceb86", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814438, "uuid": "96fb08ff-e80d-40f4-98da-cd86389a623a", "comment": "Malware payload (Dridex)", "value": "3d872f37f1ef0a668453e6ab3b2ddffe7cf1b7354a6209b3581d22c6ebbafde94f38b4883035b4f9f4d3612835d72fe1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814438, "uuid": "d6302698-28ac-46b9-b649-deb481423e8b", "value": "74F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814438, "uuid": "e3a190c0-5918-48d1-9ad7-309fecc8257e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814438, "uuid": "26166510-5c27-4155-bf80-db2737bb62b5", "value": "3072:Alpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Alo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814438, "uuid": "16c22195-3c46-4689-b5eb-8a44f5a21396", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814438, "uuid": "d0f8492f-d286-47ee-a087-dded09d7338a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814438, "uuid": "1541ff66-1e11-4bc3-a761-d4cb186e1f5c", "value": "799500b5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937a6409-bc5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621839565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839565, "uuid": "95ba3e13-d5e0-49b5-b741-376c925d03ec", "comment": "Malware payload (Formbook)", "value": "9191f2c11d448ac2baa34768d210f3a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839565, "uuid": "68fa21c9-ec0b-4d2f-8999-3815e3b956f5", "comment": "Malware payload (Formbook)", "value": "8d27c368e6431f796a96389ac517d654ca3de20a6b9047095a47691532c7cf11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839565, "uuid": "d245df69-5ec9-4490-bfdc-b50b66765549", "comment": "Malware payload (Formbook)", "value": "d770035c19094b6116293275767100978082e55d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839565, "uuid": "e2d0cdbc-f32b-41ae-b143-b691fbfc91ac", "comment": "Malware payload (Formbook)", "value": "d1fd6e0bbe1d2d19019c3e5e96c98335dd62a26be474b29f07601ee2276fc644c0bb13e683d7c32e324cc91c61bac012", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839565, "uuid": "e9696b55-29a6-4176-9290-94b392c1a4f4", "value": "3CF39E32D641C031E2B241F5F66D1B7B843E0D353359A0AAD7E12AE16EE49E6F42931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839565, "uuid": "3e3fbc51-20f7-41dd-a994-cf2fa1f3c6eb", "value": "3072:qnB3Iv1lKekDI1xqMoAjrE6j30kSxSObtCxv4kLay2CG5ETpA:qx3DmLoAvRz0kSkObtCxv4kLDG5wpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839565, "uuid": "0b3b887e-2e74-4ce8-b680-5a0e66978aba", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839565, "uuid": "a8d08814-4db8-42d3-9ecd-1180e34de420", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839565, "uuid": "ad51f18e-834b-4220-987c-fdd39ebbf4d7", "value": "9191f2c11d448ac2baa34768d210f3a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a0b482-bc58-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621837255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837255, "uuid": "0b6ce6d6-59d4-46a0-9078-0863fd8b5b09", "comment": "Malware payload (AgentTesla)", "value": "b3d8aa88465648308e97cb51b56784d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837255, "uuid": "28fe9a7d-f67b-48e5-9522-b6de51eef71f", "comment": "Malware payload (AgentTesla)", "value": "8d7f90e302cc193b0354156b066c1ed3691ea6930a6b09e888dcb5ba4504630b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837255, "uuid": "28a0c499-8df3-48dc-9c2a-675dca8612aa", "comment": "Malware payload (AgentTesla)", "value": "a951b5952fbb3b12273a148bf98595839a229a72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837255, "uuid": "0b2f24bd-d38d-4092-a0bd-4de7cfa0e395", "comment": "Malware payload (AgentTesla)", "value": "3bb281c52dcd716c3f57d018763b0b605dec7f4e7c717950f5584caafa280eae7f8c9b6c5f0a4217a890ffbf13337ea1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837255, "uuid": "39ba0f71-c730-4d1c-84b2-a9c818667426", "value": "1FD423D59FE186DA2A7817B1BCFD9B15422352B5069F83B12820B735103CFA76BC09F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837255, "uuid": "d27a4458-fcfa-45e3-8bfb-2048b2ff42db", "value": "12288:GP0GWWcUej/8pCn1L2WbAi9R1QsPfaSCmkx+hh1U7fZ9++erWqyxZXdw+L:yu8Apb1QWCmkMhh1U7hbXzjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837255, "uuid": "77b44c3b-ec6e-4914-aeb7-30b790c06715", "value": 654177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837255, "uuid": "e752e469-52f4-40ce-8470-48752a8d27bb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837255, "uuid": "287dd415-1376-479a-8ea3-d1ae45784ce2", "value": "attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48eb69d4-bc4f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621833427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621833427, "uuid": "6bff3429-6add-4b6f-87e6-1455127773df", "comment": "Malware payload (AgentTesla)", "value": "2f288042ebb73ac69782cc7d19850f36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621833427, "uuid": "f82b5780-fd3c-4d82-b23a-358d40485b7c", "comment": "Malware payload (AgentTesla)", "value": "8e0c15193230aaf062e9961323dbee752ea40383013b6533796bb162edf1e3cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621833427, "uuid": "1319a063-0ae2-4ce2-b7a0-d5add7cc7e33", "comment": "Malware payload (AgentTesla)", "value": "fdfd67fdb1b28f9beeb3f2cb709f9724e9189b76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621833427, "uuid": "db2a103b-d817-4eee-8a57-fc611147db0b", "comment": "Malware payload (AgentTesla)", "value": "c83abb20a80ab977b1bbef47744fd7e493377f5e9116f94d80e09ac2316033e8f8f7ca3301200cfeae1ace077bb24520", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621833427, "uuid": "2d6ca20e-d4e0-45d9-a242-837ec718b26b", "value": "1235E21CA119A231F4A8C13549D3B227ED18DB336020AD55AAF7175F2F73EC1BB4A1AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621833427, "uuid": "bf4bf164-5802-4a6b-948d-f7785d4fdc8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621833427, "uuid": "675db97d-43f7-48e0-8bf6-674976de2977", "value": "24576:5ktTXacq5NS9Gm9fxbmWFN+RkE0raBaw:G4NRm95bzFNXEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621833427, "uuid": "9780c95d-16c6-4b55-bcca-6b15eec8d369", "value": 1107968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621833427, "uuid": "7c671cd6-77bc-43b6-8ed8-235aca2e2e14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621833427, "uuid": "570fcb5c-a1fd-4eb4-aea9-44c8a95ba341", "value": "SecuriteInfo.com.UDS.Trojan.MSIL.Crypt.gen.10663.18102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074d28e1-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821721, "uuid": "ee1e7ba0-88ba-490b-a5d2-7b6bffdbf7cc", "comment": "Malware payload (Dridex)", "value": "7e291f349d573d071d3c87bbbfe54880", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821721, "uuid": "3f63b38d-5cdb-49f3-aa2b-230c9280feea", "comment": "Malware payload (Dridex)", "value": "8e16fe1539d7ae7eb133511aaec05c6dd119cb155cb3395b6c18abec0520733d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821721, "uuid": "a5ad2c74-c5bc-462c-a747-5a8ee91e04ad", "comment": "Malware payload (Dridex)", "value": "196d7ee761d10f15ad1e85b5bcfc7ecaec105410", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821721, "uuid": "56a9ad4a-2230-494b-8c01-669fb21b9d38", "comment": "Malware payload (Dridex)", "value": "df0e538ae78316297f627da28c4ea34a43fe87c81289bb5500d36c70577d6c99d24134cbd63057835301b63d2ec29da9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821721, "uuid": "ab7cea9a-f061-4951-b13b-60d2ad482f5e", "value": "74F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821721, "uuid": "f5affd89-8ace-41b2-a1f2-9961dcd4f6e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821721, "uuid": "0d14334d-0a36-4cfa-b0dc-ed1252115232", "value": "3072:TIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Ec7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821721, "uuid": "9ea2f327-a0ea-4b0b-ac17-ab5f8073d143", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821721, "uuid": "9acd6177-489b-4896-bf97-3366e7efd552", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821721, "uuid": "76670287-9593-4576-b78a-00c14bb2180c", "value": "7e291f34_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e95bb0-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825263, "uuid": "ce172e36-95e7-49a1-936c-8877b9c02603", "comment": "Malware payload (Dridex)", "value": "29838d2ba51fb127c3893d379a3029b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825263, "uuid": "a08c8263-229a-4d8e-bd38-0d9722625a45", "comment": "Malware payload (Dridex)", "value": "8ebc1262312312b8ca81c700a364e9e493ac21f92711f5e5220f097753597a00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825263, "uuid": "ac0e149b-9a53-4b05-b592-b1c4aa42a5a9", "comment": "Malware payload (Dridex)", "value": "bee1fa2a73cccbb3f122a367a3873251b4dafe23", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825263, "uuid": "1d774adb-8ed3-4773-9df5-ee18a18e159e", "comment": "Malware payload (Dridex)", "value": "65c688ac32955866391b42d84f367a6169130b60cbf43f1fc56e98f1bdc1d1f48749fee4466c01d1862916180a48a12f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825263, "uuid": "b951bba8-bbeb-4e65-b712-cbc11dcd1363", "value": "45F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825263, "uuid": "12599acd-e4b2-4225-b5c7-498b652e369c", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825263, "uuid": "6dd9cec7-11d1-480c-b26c-95c90a716c93", "value": "3072:8iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:feAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825263, "uuid": "8ec92aa2-88fe-48e6-835b-36f1f712cd38", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825263, "uuid": "68ae3744-0ba5-448e-8a82-8155eeafd7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825263, "uuid": "3cb40f80-bf95-4211-a112-9e1ddf6ec573", "value": "29838d2b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac14ec03-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621882986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882986, "uuid": "d53c6851-a3ad-4fc7-9415-f6960dfa83c6", "comment": "Malware payload (Quakbot)", "value": "72c4ef658309a638e46775feea52a783", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882986, "uuid": "476b52b5-f48e-494a-b39e-b6af93236bb2", "comment": "Malware payload (Quakbot)", "value": "8f475f3699ee5798f0364a39da6cb668aa89dd20879e41d4a394e1b66ed9f09a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882986, "uuid": "f83fc0bb-f598-4af4-8044-0595e689979b", "comment": "Malware payload (Quakbot)", "value": "2411964729272fe90185510b430c4bd0b6d9034d", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882986, "uuid": "1ccb53ef-47a5-48d8-8e6e-02c93235506d", "comment": "Malware payload (Quakbot)", "value": "07c28476eb2b8ead2c73eff3e9d8a239e31b7ede33dd2e7d87ebd3864aa369cf1dc808a89a81de7cd238963b6b1ac4ea", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882986, "uuid": "a51af8a5-c5c2-4eca-baad-9c5ad8afee26", "value": "0984F26377CEC006FBAB0F3EB527961045F5AD5724B3867A11D035A8F9B2A3008D6B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882986, "uuid": "e5f037da-8a5e-4d2c-a03e-73552ecb8670", "value": "88d1baac157ea158bb0b90cc43e63e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882986, "uuid": "976894b3-1a0b-4ea5-ba9e-18606377abf5", "value": "6144:pz4d4LL71s2EuhNJxwNNSL3KBTN1phwe7:uWLL7WZANfwa7YTN1pht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882986, "uuid": "e849b3ab-32e9-4201-a934-46e8a57bb314", "value": 384944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882986, "uuid": "98163deb-de5c-4d2c-a982-7cbb4e034353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882986, "uuid": "d2844de0-8b6f-4c49-97dc-a4f8ea23fbd2", "value": "72c4ef65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddfce76-bca4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621870211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870211, "uuid": "defc7675-19ec-4316-93e4-12eb5c4f1212", "comment": "Malware payload (Formbook)", "value": "54d8c63890ae6e29d5ae01d6f018f170", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870211, "uuid": "87e8ec59-8257-4e3c-a9a5-60e2e9ad867e", "comment": "Malware payload (Formbook)", "value": "8f7e426d05704b634e2ca0b16b3603dc4ea26643879c20e3c0fb99a92597a770", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870211, "uuid": "0211a230-d41e-4e55-a5aa-eea26aa8ba82", "comment": "Malware payload (Formbook)", "value": "4fd1281b03b57334ad3c38ed177683aa6176b471", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870211, "uuid": "cdf64b3c-051e-49fd-8ea7-3decdaf75d37", "comment": "Malware payload (Formbook)", "value": "54535e8fbecbe6e90cfbc9a452e0f88d91c717d330e8824e9d1077948bad6adba99ff48c0dea9f6181d7f466bec9a7ab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870211, "uuid": "c921bbba-890e-4689-afc5-9230d295309a", "value": "E765239508A317E6C81B81342196FD314538CD49E32CCC4BB6C9BA26A77E1F35BDA39D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870211, "uuid": "49e6b122-047a-4d89-ab74-a3f00cc9ece2", "value": "24576:Cpady1rbxERws4MW+JA0yIz02QffQYo5QPAnmiNNSh1c3j2+U/DX:ArKV4MWCA0yIzMfQYrPAbNch1tb/DX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870211, "uuid": "756df950-7cb2-44c6-af42-482b8f9b20e6", "value": 1414144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870211, "uuid": "507dfb5b-b966-4fdf-ad28-4dccadb71862", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870211, "uuid": "9fa0e936-7296-462e-af88-07e8c5352267", "value": "Contract RFQ01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067c2a9c-bc38-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621823437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823437, "uuid": "a684654d-ee7e-4e0f-852d-804e9e567c9a", "comment": "Malware payload (RedLineStealer)", "value": "8020a6c95843b30d3ce517afbbdd54be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823437, "uuid": "3e82f805-8658-4160-83de-55288b6beb2c", "comment": "Malware payload (RedLineStealer)", "value": "8fa164b42459bf406959e367a93e78c40b1481a0dd858f6ce400ca53333cfc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823437, "uuid": "3d5234f6-de58-4143-80dd-ba205e08715c", "comment": "Malware payload (RedLineStealer)", "value": "1f231a77bec6af6be6064da02a8d75c171fcd801", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621823437, "uuid": "d4732e80-d406-449f-a994-fd2fae71be22", "comment": "Malware payload (RedLineStealer)", "value": "ce3d36f323a12078ffc81a34cef7bf821b8d142a4522cfbe9f4172c18a633c81ce8f3f685bc7a93ca1719b5351a24795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823437, "uuid": "85f5c6db-bc13-4676-aad2-6ea6c1043a58", "value": "B883F10A0AEC7571C7AC4ABC9673E7110766E0B259A4EF8FBE5821911D063EF1C1367B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823437, "uuid": "9f96f853-dadd-4884-9887-edd6db414d0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823437, "uuid": "1dc92e89-f2d2-4a5c-8a5e-17bd413f3e32", "value": "1536:XXxm5QD0pnx3DF4TST6YD72virAVde7jBzR30ZXsI1qFNThrDP2ytmE6k/NCG:Hw5QD2nxTUSJyvirf7VSZ8I4hUytmExH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621823437, "uuid": "741224e5-2377-4a57-970a-ac65499014cf", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621823437, "uuid": "97aeb81f-1671-48fc-990f-c43500cb47c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621823437, "uuid": "c502d5ec-1b69-4afc-8ab8-0b1896643571", "value": "8020A6C95843B30D3CE517AFBBDD54BE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "427b0091-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890110, "uuid": "48bc1199-0b34-45d8-bd8a-5b8d6ed0c16d", "comment": "Malware payload", "value": "af7213f215cc7609a220f15c78f06d6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890110, "uuid": "3279901e-eacd-4bae-ae31-c4a3422eae4d", "comment": "Malware payload", "value": "8fd9f6ad00f5fa27b51e4bf8abc21331325b5214ba38ea265744f4978172b7db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890110, "uuid": "bee84bb7-d548-4639-8cb5-009db78f0e1b", "comment": "Malware payload", "value": "bef6058e0f8499767526329a90f1e98dad5bfe13", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890110, "uuid": "6691e46d-860f-49ec-91c2-a4514268f6ad", "comment": "Malware payload", "value": "a32b30a31164f4c3f7ec63fec47a7fc7dea6a7007b462c8c10035ec9881e5a252b29ebfa0c3eacaf1f749ce92d920e89", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890110, "uuid": "f14b1305-0af7-4ea5-9522-d5481fb1403b", "value": "C6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890110, "uuid": "a2f3d532-7d98-4835-9231-a99b021a8e1e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890110, "uuid": "7e992059-8595-406b-89f7-37fd474ee817", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890110, "uuid": "57da6364-2366-4948-9220-a943cd6696e8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890110, "uuid": "4e1a421d-a60c-437f-b03f-3f4c3d0925aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890110, "uuid": "938ab67e-b1bb-4996-956a-bd2d07e64e0e", "value": "af7213f2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263d023b-bc74-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1621849260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849260, "uuid": "149c93c8-0dc9-456c-84a1-20042122b36e", "comment": "Malware payload (RedLineStealer)", "value": "dfb3f440455bb877712972e39c58b91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849260, "uuid": "2b776ef5-09b2-4051-b1fe-5618867e0d15", "comment": "Malware payload (RedLineStealer)", "value": "9008a568fc397b90f88fe727e88fb82f1d0cedf3886f87a195e7eac8188a4394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849260, "uuid": "fa7f1b5d-5f0a-4cf9-b27f-c66aa6654116", "comment": "Malware payload (RedLineStealer)", "value": "6ba324d32ab408769673d5227b89e5e14f9e5840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621849260, "uuid": "8fe83146-2f90-4738-bc69-871542b97722", "comment": "Malware payload (RedLineStealer)", "value": "3dbe6356a06f8d50d60d580336fa238f0c2d6a2a4800993d5d4292f4f751857cedc3219ba9a2dcfb0fc0b8fbc9e3aa86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849260, "uuid": "f5389d28-73e0-48ef-a85c-07ccc36b1a31", "value": "8455E192750086E1F8AC4A73E54748810761BC37A5E3E6577AE9B32E00277B3491EBDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849260, "uuid": "a65ab79b-9353-4893-b01a-bed8bc9add94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849260, "uuid": "2d20a5cb-e889-4009-9de6-781fab23181a", "value": "24576:hr4uE0q5nTAhMMNx49EAK/iMMiOS8C9JVoHoN25UO1MMNx49EAK/iMMiOS8C9JVe:5ElRsMM/4CiMMivfoIs5UO1MM/4CiMM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621849260, "uuid": "e6db9814-b104-416d-be60-406c1e291af8", "value": 1395712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621849260, "uuid": "c9602226-9622-474e-ac6b-e6ac21288411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621849260, "uuid": "9d48a2df-933d-4ec3-9a83-156a95c03829", "value": "DFB3F440455BB877712972E39C58B91A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1081357-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621854218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854218, "uuid": "a8765ac8-29ab-484e-a656-840b11200ba0", "comment": "Malware payload", "value": "fc25d87cea167542d190d51d67eec1d8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854218, "uuid": "78b25205-d179-4e0e-849a-3f1be6799320", "comment": "Malware payload", "value": "90187a344118429f9a76583ea831293de2a75b97956ba41659e9a0977e62f979", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854218, "uuid": "4b88632d-8b73-484e-83d3-a1376f00e3c7", "comment": "Malware payload", "value": "a5f2b903a125e8be833240dc4db600887260ac5a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854218, "uuid": "9845701b-c28e-451d-9c09-ab227cbb493b", "comment": "Malware payload", "value": "3af40dab7c44011463dacc36961c6950137d1790c711ada2e977e2367fd7607c9fd723562007cd2fb4434ab76affff41", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854218, "uuid": "3cfd720a-52a0-450b-8df8-d5f64c92b395", "value": "D23533312769C463EF947232870B6B5EC8F96B97247681D9AE13B1F1BA114870D8CB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854218, "uuid": "8c1dd2f4-1a5b-4e5c-a04c-72e1ee8fa869", "value": "24576:cEMDWmN7CR3BkiOr8RLb7KVf06XIe1hOPfWCDyh4QSdcZrj:jmV7QkH8RIqLU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854218, "uuid": "6f8976c4-73aa-4452-a880-daed8cb2a949", "value": 1086343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854218, "uuid": "d6f3dcc8-5d08-47b4-b1fe-95bbea2c01cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854218, "uuid": "b76fef7a-cb14-4d14-a892-87578b217c44", "value": "Tuya Wifi camera & kits- Viewell Electronics Technology.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8147db5-bcc5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621884402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884402, "uuid": "d6dd182f-5c00-4339-b5c6-96c0f0ff3450", "comment": "Malware payload", "value": "260974972020d722766745af9334701e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884402, "uuid": "5431986a-0adb-49c9-ba6b-ad322e16fcb1", "comment": "Malware payload", "value": "9084e52dcbc7f1ae40e2e077114f70477d2954cf149cabde5c83439f75ff13cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884402, "uuid": "3ce1d5bf-9f37-49b0-bb3d-e88a261ef4e2", "comment": "Malware payload", "value": "b64f9ed416be9415aefa958b5abe0d4fc7d042a9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884402, "uuid": "9ee96e60-6c46-4b69-a805-46be30943745", "comment": "Malware payload", "value": "dc38935ae3599a12134bdb1584c8f66fca58df33843e433a4bce7a6667233e8ddb47594af1475a71c93a368a9415b464", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884402, "uuid": "4326ad2b-2579-4dcc-b076-2046ea537ffe", "value": "D387592C156AF522D6A8C2794AD4403BE591DF333131BD69E8D33F587739E80B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884402, "uuid": "646d5333-bf5a-4719-8164-741d337a5f07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884402, "uuid": "210da6b5-1e4b-43eb-8513-52faa06ec84a", "value": "12288:t2jBCPy+FznChQkPbeVVZHPhlhLiyCCTVJKga/RJyVeYdQ0dBwgk/YRg2:YBCPDtkPbexPhfLi6D3qR/Yu00gk/YR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621884402, "uuid": "ce51c07c-4a41-4333-a385-23186952a096", "value": 38797312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621884402, "uuid": "c50aa322-0568-46f8-9beb-f5521798d5f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884402, "uuid": "4fda6d94-4ed2-4eff-8f25-5f50eec39f09", "value": "P.O 070814-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cacdedc-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854103, "uuid": "609859ee-54a4-4628-beb2-8d1ec80cba3a", "comment": "Malware payload (Dridex)", "value": "2ccd4398640aa24f74f1f9f35851a110", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854103, "uuid": "b5f21ca7-6829-44f1-80a1-486684fe7fd3", "comment": "Malware payload (Dridex)", "value": "908e4d0943bc29bd98081ec77757e82bae419e51746deaad2029adf6ad37b4db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854103, "uuid": "5db8e6e8-8d2e-4a76-8196-b06970ca63e0", "comment": "Malware payload (Dridex)", "value": "7baafd916efce8c8351975a04c620b4fd7c8d6d7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854103, "uuid": "23332d07-7f44-45f8-a319-1c4fe81fbb3e", "comment": "Malware payload (Dridex)", "value": "f20d83b2ca6af7fd60606014867d22441fb2a641ebacc79a19652d84ab166c176b11da9c2b70e5161770c11754d03a2c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854103, "uuid": "0fd1814d-b5d4-4f08-8381-2eb21b589f29", "value": "0DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854103, "uuid": "a9ddce39-0d04-4eb2-be6c-f4d55d70506b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854103, "uuid": "155daa8c-d6a2-442c-93e4-39034d297614", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854103, "uuid": "eb1592b5-050c-45ee-b368-81f6ee839564", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854103, "uuid": "4d31932f-3c07-4b43-8e69-9dcd9fe75ebe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854103, "uuid": "9e1261ad-80a6-4cae-9aad-7346c8f39398", "value": "2ccd4398_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65630c9-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897257, "uuid": "e263b8b3-681f-4247-b8ae-20e1c5de69a0", "comment": "Malware payload", "value": "d562e56f49f632ea7abd116df2d1c11a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897257, "uuid": "62f23c8d-fbee-47d3-acfb-bbb42993f7bd", "comment": "Malware payload", "value": "90e6503171e3900122b109621c241f706f706b1ac72d43211f544c780d2cf8a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897257, "uuid": "b604e0be-4675-4557-b7f2-4b07495e26ae", "comment": "Malware payload", "value": "311b75185ed77a3733e4f6f1b044613f92858382", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897257, "uuid": "3d967fad-4113-47e5-844e-a0f271962497", "comment": "Malware payload", "value": "c0a2a1f152fcdd7ca831678dbc81c3fc5b8e0f5e5017a1e2853518e29830d8f6c4644b09b87a1abccf4e5747274114d7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897257, "uuid": "b1daac46-4c26-48d5-a562-f4d205160a27", "value": "5FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897257, "uuid": "c4a53b2d-04eb-4fe7-a170-f8471559f44d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897257, "uuid": "79a4659f-b57d-4253-9153-5f17ec170715", "value": "3072:Clpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Clo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897257, "uuid": "6b870c45-2629-498a-bae5-bee366e05362", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897257, "uuid": "d2b4e771-18be-499d-a04f-d7ecdfed7051", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897257, "uuid": "d37d9546-a599-4c29-8f66-423856d3022a", "value": "d562e56f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eae5ec7-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854106, "uuid": "175b904f-d531-47cc-b663-54767b817d42", "comment": "Malware payload (Dridex)", "value": "557301972a00286bf60ebfd5e2a69097", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854106, "uuid": "8d6bcaac-b1bd-462a-a0dc-39b6738581c4", "comment": "Malware payload (Dridex)", "value": "9133a1d000f1cddf2994c7061a3e4f8cf4789e0ef1e2d470e3bb0fb8838b22f1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854106, "uuid": "607e8d34-7caf-41e5-a48b-064920feec98", "comment": "Malware payload (Dridex)", "value": "5a18a992137ce424f675a98d272b2280bf6f42b0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854106, "uuid": "859a903c-a787-44e9-8058-ac3b216a9754", "comment": "Malware payload (Dridex)", "value": "157a62aeecdec2cf4ca7a35cff7aeabdf4225eede55c336f2f3fe362e800943f140bada7388b425902c8f735784db9bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854106, "uuid": "c68cd927-5833-4df6-b22c-c320a30fcedb", "value": "21F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854106, "uuid": "107af02a-3c40-4853-b279-2c1d303fc3ce", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854106, "uuid": "f2e5f96d-7452-4f02-89a9-cfe747089dde", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854106, "uuid": "b9ddd8e8-5c9b-4fb1-bada-4057cd58f0c2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854106, "uuid": "d2fb5516-03e7-4fee-a1cc-fc5814c0fb9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854106, "uuid": "fb1b8aac-1782-456e-b331-236776003260", "value": "55730197_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1537b42-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621886484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886484, "uuid": "13aa87f5-3790-4e87-a2e1-fb6a5cdc4631", "comment": "Malware payload (Quakbot)", "value": "b8367ae7b9c49aeafef16ac3e3bf996d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886484, "uuid": "93f3d354-68b9-4510-802c-1a2a381c017c", "comment": "Malware payload (Quakbot)", "value": "915e6b821a4d174598c27f8d6ffea83e9abaf880870380aba652eba0804682e3", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886484, "uuid": "59049423-d553-400d-924a-a7c3bcca2b87", "comment": "Malware payload (Quakbot)", "value": "72a554884b28d2fada4232f5e181f451977c91e1", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886484, "uuid": "cedad42c-35a8-48e4-b660-bbf6368b257c", "comment": "Malware payload (Quakbot)", "value": "0e0fc68ee59c6c755ea2dad8f980651cf9c1b4834d4bae8fa5a48fd5b10b2df8a662718a9117b008cccbb5e69c58d2a7", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886484, "uuid": "2a88e159-a8f7-4d7b-86ef-2c85f58a01b3", "value": "5684F26377CEC006FBAB0F3EB527961045F5AD5724B3867A11D035A8F9B2A3008D6B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886484, "uuid": "c6c0cfbd-ae0b-4c9a-b321-1f65ba11f487", "value": "88d1baac157ea158bb0b90cc43e63e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886484, "uuid": "a6470f99-07a7-4571-ba4f-41f3053020af", "value": "6144:Uz4d4LL71s2EuhNJxwNNSL3KBTN1phws3:RWLL7WZANfwa7YTN1phr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886484, "uuid": "efc5b91f-7c1d-444c-ac16-a117951f967d", "value": 384944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886484, "uuid": "e44493a2-73c8-47b7-95cd-8202c7c2488d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886484, "uuid": "3ea26107-9085-40ea-a524-b15685f78789", "value": "b8367ae7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cca4aa4-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893671, "uuid": "650d0a92-ee25-421b-871d-d6e0fa081125", "comment": "Malware payload", "value": "62b9512f7df402e5c4394e9d5730f9a5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893671, "uuid": "a83c03b7-0605-4af4-a816-f9381f0cf3b5", "comment": "Malware payload", "value": "91c9dfca15df21140ec0e6ca647ff9ddcdcf1f4db4e82a17bf84ad06cb3fc260", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893671, "uuid": "be56d524-287c-4540-9d78-445b558f35c8", "comment": "Malware payload", "value": "90fb71a2af61dc92ab580c236f77a9a31b7897e6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893671, "uuid": "d637857e-bf11-419a-bd26-b7387e051b47", "comment": "Malware payload", "value": "91d6b2ad3a8da604ce76d3761b62c7e092c4a74165f9f010d40df6177f9483c4326afd76fa409258a1562130c8cd5cfc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893671, "uuid": "197da953-f9cb-49b5-aebf-dae884c92944", "value": "C5F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893671, "uuid": "8c99dbee-79ea-4fe0-8487-97a2a2c37c4a", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893671, "uuid": "89034e3e-e801-4d56-aa5c-72d92e1de8b9", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893671, "uuid": "f559ace3-a69c-4168-8a88-e75fc9ee0bf3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893671, "uuid": "8696dfda-03fb-4613-95a1-9f59ee54e8d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893671, "uuid": "33672808-c70d-48e4-83ed-67c9930553f9", "value": "62b9512f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4791dd-bc9f-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1621867689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867689, "uuid": "0564f41d-847f-4235-99cc-1514eb0cf15b", "comment": "Malware payload (QuasarRAT)", "value": "2f460b94a9e53fb676aa84a66ff51424", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867689, "uuid": "3ddcc62c-a6d2-45dd-becf-253d5b52167f", "comment": "Malware payload (QuasarRAT)", "value": "91dfd17bf11e35a714076e1e4e403d0a95573a9e1bfb7485d249085be890f62a", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867689, "uuid": "481cb532-c02a-4b38-af53-0c9a32635118", "comment": "Malware payload (QuasarRAT)", "value": "d7e500dc0bb526dd8b688e806633882044a404cc", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867689, "uuid": "b930d6db-6c8d-4e2d-aa40-588943b91053", "comment": "Malware payload (QuasarRAT)", "value": "0532f2e6dac110417af35b550d36ead4fa4ecf90d77c7e7fec857f6459c8c7a8ef20400d1ee1f0b779fa27a4ff369cb9", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867689, "uuid": "02a02ced-c5bc-4cf7-afcd-ba2b01d0e08d", "value": "A9442341296875E1382BF81F25FC59767F614A45E7FB301DE132438A0A6F8C836AA5FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867689, "uuid": "f930d913-c2a1-4af4-9674-78821bcaf62f", "value": "6144:SQuTEk+0xqqOhd9JuMGSn0U3+VSOMPY7xwBuh1McIDJGrBJXGRWx:SQuYtfNzIM9n3ZQPvAWTXiWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867689, "uuid": "ea6795ab-04fe-4d6d-ba22-8694ba278d51", "value": 278417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867689, "uuid": "ac966d7d-5e9a-46ff-bb53-fc1c464785cc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867689, "uuid": "4ef388b5-5644-4b2e-a5a4-7f20d69bdff9", "value": "4090800.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95a701f-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846903, "uuid": "d9972e83-fd48-4287-9625-fb688f295018", "comment": "Malware payload (Dridex)", "value": "38ac333994deafadcb478ae91884d70e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846903, "uuid": "c59412d0-0c00-440e-b4fb-631c3bc55aee", "comment": "Malware payload (Dridex)", "value": "91dfd434cbca0bc3a9027387926b3171e06622922c59cbdf966e511fa5e0e4e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846903, "uuid": "cacc092d-4788-4a6e-8e53-df932b513fae", "comment": "Malware payload (Dridex)", "value": "6c4dda31f5bc55e26d75d55e572de0cf4adc566f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846903, "uuid": "cbfd74bf-dfeb-4aeb-9e46-10a07a566544", "comment": "Malware payload (Dridex)", "value": "9deae0670fdb3eef314956fd85b46a60806faf25901fab5163e9aed2b80ae098a31cd41da3a7dcfe2fb0abc88490e69d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846903, "uuid": "a34adf2a-b3fa-471e-a9b2-abf2b824567d", "value": "5AF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846903, "uuid": "af450097-e57c-4b01-b4d7-1d5c91f857df", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846903, "uuid": "e643cf41-67da-4978-bf8b-f2a29bf8753f", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846903, "uuid": "ecf8ddcd-e1b7-4727-9665-e2b7f0a77574", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846903, "uuid": "f0098e0c-f10a-49f2-a0db-9cc7ae3b4312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846903, "uuid": "eaf4df80-3c54-490f-b762-5254ffc0b589", "value": "38ac3339_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc93153c-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818159, "uuid": "1348f876-fc98-41f2-8771-e08b50af3a56", "comment": "Malware payload (Dridex)", "value": "9e595fea686e3340bb2678d7edaef00d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818159, "uuid": "f14c4b06-e4ae-47ce-9cf5-285b839cc19a", "comment": "Malware payload (Dridex)", "value": "9208a12e62e0e5edc04a65ceb864de357dcfd2af9492381c86f1a439c38fc563", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818159, "uuid": "b2e2e27e-899d-45de-9aaf-7e0f220a8bd1", "comment": "Malware payload (Dridex)", "value": "55b3efe24fc6cf4be6aa0eb2722b15c418618575", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818159, "uuid": "2a6555c3-7990-4a16-a1c8-5cedb4f5c1cc", "comment": "Malware payload (Dridex)", "value": "9c6be766e9fa2d83db2966d36adec56e7eb3f1cdae86b28e5ea62e1822a275a5d6c49ba2bc8f45e2783677dd7d753349", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818159, "uuid": "150d8a26-3cde-4f90-a992-fa74206ef2b5", "value": "FDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818159, "uuid": "639850ca-6bea-4d07-ba05-1afd6ad59625", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818159, "uuid": "4a434416-99a3-4d62-975c-be4c2a130457", "value": "3072:omNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818159, "uuid": "a6fd816f-583c-4513-a75a-7b90c26536a2", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818159, "uuid": "b1feac20-ea56-4109-a2a2-246d408ccc1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818159, "uuid": "666f751a-12f2-442a-b069-f0eb22ad3e9e", "value": "9e595fea_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dcbcc6-bcb7-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621878244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878244, "uuid": "ce4acb8e-e4e9-4319-8d46-da1ddbd88096", "comment": "Malware payload (Formbook)", "value": "d5a83e001105b2103980ea0c575e017b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878244, "uuid": "df7a668b-6764-4989-b04c-cec455ff1dc7", "comment": "Malware payload (Formbook)", "value": "920d5b079a7684340c82b1334d87f828f4820b54437da0d109b381fdae39ac92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878244, "uuid": "fa7ad446-2045-4ba8-b288-c27a24bbb47c", "comment": "Malware payload (Formbook)", "value": "21ea82f096df9216f3845ec53bb0757923832778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878244, "uuid": "f6f9ee4e-f239-48ce-a70d-25a37b121569", "comment": "Malware payload (Formbook)", "value": "4e8c674db3d6a1563c1662ff31dc4637bd97331a9d6cb3392d93a1ab904afb595ce207cc7adc983f7063debaddef6a19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878244, "uuid": "efa0013d-abf6-4e2e-b944-8f706f916273", "value": "C734124A20C154ABD453077216BBAB8ECBFBF7485A5022ABBB580F5F5F351C3D624247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878244, "uuid": "acb7d306-5827-43d1-b14c-3438597c3741", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878244, "uuid": "ab011ac0-5c20-4720-943d-b2e02e145c11", "value": "6144:8sB+EwXRfUqrKBAtLRYloVYkYK5zK2mA1aBuSyO6u501u:F+EwXRfNrKB4R1VYkYKRSuu5z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878244, "uuid": "b7ac07d7-2536-4bde-87e1-154c253b7bb9", "value": 237848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878244, "uuid": "7b7fead1-4964-45f0-a38d-73c06d48491b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878244, "uuid": "052184a7-b60d-4917-9ef0-6c9633415b38", "value": "pedido n\u00ba 499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fbf011-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821737, "uuid": "f1e1dded-bb74-43ea-ab58-304d2d681874", "comment": "Malware payload (Dridex)", "value": "7479e2cb2aef5e6f739ab8d3542e1771", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821737, "uuid": "107678ac-caf4-4e87-a81c-b165c9ac37e7", "comment": "Malware payload (Dridex)", "value": "92979dbd29281b882d43fef03a2841d1235adbf894cfc264a7ffae9e467cecfc", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821737, "uuid": "8265d451-08ce-4b5c-a771-e1af2fd13049", "comment": "Malware payload (Dridex)", "value": "a46f1b06bad05c5ed7ba9a042e975eca5a32181b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821737, "uuid": "700ff87f-324d-45bf-898a-4b86dbaa4f8d", "comment": "Malware payload (Dridex)", "value": "ff0d55f51cf2848ebb1eb241f6dec885202f9e8abcb0a9b61440865ce926fb75f370c5ca00eea37a70a44899ff5edada", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821737, "uuid": "ffe0bcf2-cdce-4466-b888-2d2baa17607f", "value": "E1F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821737, "uuid": "e9cc27e1-4e3b-46c6-8df2-68b922db8a70", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821737, "uuid": "278d2ea2-f8e1-4262-863a-7e9a9853c8bf", "value": "3072:S9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:S9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821737, "uuid": "e6d38ec9-0510-46d3-a65a-6ad95d2ee761", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821737, "uuid": "49d018ba-8d33-47bf-8aaa-bd019d647e58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821737, "uuid": "dec6a50d-ab47-45b1-a67e-a1d0ac2229e1", "value": "7479e2cb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a048cb-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621846927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846927, "uuid": "fb6cf55d-7402-4d52-9b29-21b8e7388bd0", "comment": "Malware payload", "value": "c587d6ef02c4a53e2dcfc3b5517df3b6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846927, "uuid": "27510d69-a829-439c-beb8-72c99cd22dfe", "comment": "Malware payload", "value": "92a65d62d2a5f723131cafe6e13989c8ea0cc3fb597a96b222845595f12c07ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846927, "uuid": "97d657f8-13a0-4fb9-8749-cd2965bb3245", "comment": "Malware payload", "value": "714851648028662397bba6a0c008e73f4e4657bc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846927, "uuid": "9bed2d10-19ab-4a47-a323-baac5aac7927", "comment": "Malware payload", "value": "93bfffb5d21fbac5c41d6a8b3f2efa3991f143ce5e74d2292894068380f63452c2f6cd687dc11f6924d85335dabbc3f2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846927, "uuid": "39453118-7604-469e-ba6b-fc05e48679e6", "value": "E682D0E663E9B834F11E7330BB1349662A7097C1AC50C782391C9F11EF97A3BC891432", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846927, "uuid": "08686ce4-6711-4fed-8c86-f5b928da57f7", "value": "384:oA603P2Rp/dT/WwRhfsNsEta38r7pMrtNEHJC4dLDBJm:oA60/aZffsqEtaEpC4dLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846927, "uuid": "89d52c58-ec5e-4060-873d-76b57fd9576e", "value": 18256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846927, "uuid": "6a6f9c54-972f-49b7-b900-a776283a6e0f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846927, "uuid": "3ef0f7ab-3438-4ad0-bca9-2208097983f7", "value": "c587d6ef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2efece2e-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832525, "uuid": "b47f7bca-c99b-40dd-97cc-a62454840f34", "comment": "Malware payload (Dridex)", "value": "bf20fdad28a31c3d66587d909fe35f14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832525, "uuid": "b7b6b7c9-6d51-4f29-bf90-06efb5ca7be9", "comment": "Malware payload (Dridex)", "value": "92b32c43e0cb3c93e6641a933f8dcdb67ddf3de1fdd20e7ccff1a963123656ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832525, "uuid": "0ed53ca9-7c77-40cf-883f-ebd0da21c32e", "comment": "Malware payload (Dridex)", "value": "66d334d4f3da4b41704883ef102990aa5d312132", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832525, "uuid": "b7da3193-de3c-415b-a859-c795d8969f79", "comment": "Malware payload (Dridex)", "value": "5aa6738790ec074c10c0e1db8518878872b089fa756511b651e9586f4bf4c34a19feb1c022b95055241c48eb266af24e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832525, "uuid": "78effbc1-cc03-41ff-89d0-69d1e9924922", "value": "B5F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832525, "uuid": "ed00cb7e-2820-47ce-a51a-515702e6ae17", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832525, "uuid": "236799f8-9e0b-43df-9a9b-52acf578fbbc", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832525, "uuid": "920b6f01-7bd1-4adf-83c8-6f7821614922", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832525, "uuid": "33a2d2fa-1bde-45e0-8aea-ef9a3aa63305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832525, "uuid": "aceeddc7-868d-4575-81e6-f3c36fd2ecfa", "value": "bf20fdad_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce65b26-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621890315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890315, "uuid": "96aa6d72-271f-4d95-ab95-8585c0863521", "comment": "Malware payload (Formbook)", "value": "d3e4488ee4f30b87b4ff5aa8d517f526", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890315, "uuid": "4f9d3553-c68b-40cf-94eb-5398e1caa2c0", "comment": "Malware payload (Formbook)", "value": "92ec0fdda57232d435885971959cc65ede66e19f7ea7673798e97344008369fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890315, "uuid": "5986cd95-0a5e-4dfe-a00e-b6ba6ef7cbfe", "comment": "Malware payload (Formbook)", "value": "1113830356c3c941f5e7cbbb6e546b2d1401ced0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890315, "uuid": "f93c75f4-44f9-484a-b980-2202da13f8e2", "comment": "Malware payload (Formbook)", "value": "051d047d401f70a47db8e2224a3da35f4fec6c591a49631ff52584cf4844caaf5858ea49c6e9c6d352338f6022773df0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890315, "uuid": "21439dab-739d-4c0d-b4c9-4024e03d3b8d", "value": "A824124A32D649B9EEA72F3325E9DB2BD37FD69821100F5BA7012DAF5A15003D61D3C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890315, "uuid": "1b3fcd67-2489-47f7-a76f-646218e285ca", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890315, "uuid": "fa70816b-cea7-4459-8ae7-9ce5ac2f24c5", "value": "6144:gsu5HeyqxoIzX9ZP9GlA4DgIuuZyQXTxWXrI:25QiIztvGUIzyQmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890315, "uuid": "66a6bd0a-1361-4f77-98e5-6cb17395e4a6", "value": 221377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890315, "uuid": "ceba3546-fd06-40c9-8c28-cf13da939901", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890315, "uuid": "e6453efb-1d9f-4e15-946f-e9d9122409b1", "value": "SWIFT-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035bf182-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832451, "uuid": "7ce0d9e8-2d65-497a-b4c2-c574197c2fac", "comment": "Malware payload (Dridex)", "value": "265067bcd3c049caf769678c78b1499e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832451, "uuid": "3c339b6f-d474-44d0-ab20-475e89b6f581", "comment": "Malware payload (Dridex)", "value": "9327d2f63d8d27eb18d3281ec6820f2571130e191b27458c08fb3a5557600de8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832451, "uuid": "ec997ff6-2607-4d08-a1f3-5617bdba0558", "comment": "Malware payload (Dridex)", "value": "3f5c38893fceb0020b60aae76c8c6d23bc104173", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832451, "uuid": "9bf422b9-18de-4811-bae9-f5ee6189d913", "comment": "Malware payload (Dridex)", "value": "1eae7c599d7d3b409020f1dd7014e4a5e36d76cbd3bdcf8e7515288f5dcb99bc6638e3f614723c88cf91500d8070f216", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832451, "uuid": "9c8d9578-5d41-47b1-93c3-da50fba8491c", "value": "7AF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832451, "uuid": "512f2396-a1c9-4f0d-a5fe-9915073a7429", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832451, "uuid": "bc385756-3b96-4ce3-ac12-595a19306ec3", "value": "3072:8mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:lLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832451, "uuid": "10525f7e-68fa-49b3-b93b-71015772cf98", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832451, "uuid": "25158221-280f-4cda-adca-a6b2a1e5d052", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832451, "uuid": "f4d350c0-ef1c-4d03-abea-ea8c6f24ff57", "value": "265067bc_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93429736-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836129, "uuid": "d6e85598-f833-41ef-81be-7aa2059fed23", "comment": "Malware payload (Dridex)", "value": "78a0a7d264e6110fc53a4cde6cef32e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836129, "uuid": "7201bb78-0fd0-4518-b98c-bc2d5aff8274", "comment": "Malware payload (Dridex)", "value": "939fb257a7316331e4a25aa425f9f05fb12aefaa0c877a1ef3d308b88448b53b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836129, "uuid": "5cca8e25-bc92-499a-8adc-5975bbd2a236", "comment": "Malware payload (Dridex)", "value": "f4e9677866fdbd835e53774c021d692d4bc6a8d8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836129, "uuid": "9e096281-d67b-4b3f-bbca-cdec05a2a99c", "comment": "Malware payload (Dridex)", "value": "15e189c577918be5a4df4e77494338e74be5c5c970bc61c9ec01ff74dafec93f8b2534bb57ce39affa7eead27356571a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836129, "uuid": "87d25f6d-5ea2-4978-963c-7da2f2c02f07", "value": "CCF3D088CBB3E4E6EFB3D37966F85E1B4A1574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836129, "uuid": "90cb4b10-657c-4571-8bb7-9ef748953c42", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836129, "uuid": "e441d58e-3e17-4884-89db-909403b545a6", "value": "3072:+mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:PLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836129, "uuid": "2c92e1b2-79c8-408a-869f-e878ac62cc96", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836129, "uuid": "ade063d8-578c-42ed-9fe7-539315bec538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836129, "uuid": "ab9ebcb4-30d2-43d0-bf42-07515b69ae66", "value": "78a0a7d2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9485ec4-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897235, "uuid": "c680f2f2-bd49-4558-ab5c-9f67f6b45068", "comment": "Malware payload", "value": "9d7afccd9f93d5afe67c48add56d7699", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897235, "uuid": "3422f853-65eb-4ea3-a59d-3c672d802479", "comment": "Malware payload", "value": "93c228540b16059fe7d36e6904fc1a2a35a1536b2e4894de1646ebf59258e85e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897235, "uuid": "5c24d938-afe5-4e56-bcec-42576b8817ab", "comment": "Malware payload", "value": "431db12044ac7252446c72a61031954638a35207", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897235, "uuid": "2eb52e40-f5fa-4783-8e3a-737207d7ba21", "comment": "Malware payload", "value": "1f5706e2023c78c54a0031514bc17fbbdd4a7c05bab81080570046322287cb525317be3b21b9318b6b0ad098c686650a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897235, "uuid": "a13531fa-0983-4215-9d87-0b9e557cf7e6", "value": "3704B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897235, "uuid": "db84b807-2823-4825-9a9b-f3a03d4cc4be", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897235, "uuid": "2d4f850b-33fa-4916-b1e9-47503e5ca9d2", "value": "3072:4WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:4WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897235, "uuid": "6f6bfa29-2c9f-4cd5-a51a-4c372f2defd6", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897235, "uuid": "99227a97-92a8-4d14-a4fd-dfe1be459803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897235, "uuid": "1e5f2b84-da6c-4d02-8321-44d153220c4b", "value": "9d7afccd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4755c3-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818109, "uuid": "80cfce2d-af28-4ba8-b38a-2e3e98e9eb22", "comment": "Malware payload (Dridex)", "value": "94a33a6b861a2eeadfe20e1982336a37", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818109, "uuid": "03abd1f0-1679-4218-ba06-9f82cb7001b0", "comment": "Malware payload (Dridex)", "value": "93df976cc6841eff4c66ac754017e49250748c8803f2163fbde2f4a9cc79e026", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818109, "uuid": "e9ddf807-3dbf-42b1-bec8-2c5c1bc981aa", "comment": "Malware payload (Dridex)", "value": "d37966bd5c915036584eed2c3026fa106fff7d18", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818109, "uuid": "278aa8de-94d7-4d7e-9a47-80a6f8585447", "comment": "Malware payload (Dridex)", "value": "981645e099d1d349ef999aa3bf9b9ecc842322e1b63f16cdfc2f68bc68b13ff77e6750a42f8d6217404763276ec8b932", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818109, "uuid": "35bedaed-94bc-41ab-874d-3442b609dd91", "value": "BEF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA68F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818109, "uuid": "f90dcfa4-7a95-4277-bd84-0fd8065e6697", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818109, "uuid": "ec09aa9d-cfdb-470a-9336-be9b83ed3aae", "value": "3072:SIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:rc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818109, "uuid": "fb6e55eb-49c8-45dd-9da0-f449d826016c", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818109, "uuid": "9efacba4-4015-4e43-9a0d-5b0da6c322aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818109, "uuid": "42c69e8c-2944-49b5-b4b5-15b8b276efd1", "value": "94a33a6b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eba3d7a-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621878856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878856, "uuid": "9eaa53cf-9a3f-4511-84a4-62b18f373f70", "comment": "Malware payload", "value": "b7823e17997deec7ed2340b74ead75de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878856, "uuid": "6033fbd7-7c73-42a6-bdee-eeba067823d2", "comment": "Malware payload", "value": "9459c29cbd2a32118375f6476421a3df233c80c289a163793d560f8b7c693848", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878856, "uuid": "481f290b-9daa-40a2-b594-65bef4476ede", "comment": "Malware payload", "value": "1148dc1c9be32640b3ed740fc12eb6134bc78323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878856, "uuid": "20ca369c-b05a-4448-b42f-4c3fe17138e8", "comment": "Malware payload", "value": "4dc36802e1c43c89909dd7fb702b3b615b74bb90f627b0a4eea095929e08e17453d3b2e47070b625ba886d8191ac8a8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878856, "uuid": "eaaaff38-a8a1-407d-9156-730fe4b1f5f1", "value": "6E84AE306792C035F0BB12B449B59378A53A7DE17B3481EF62C53AEE56316E1AC3178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878856, "uuid": "c32879e5-ac1f-4900-ad08-34c5a1f0b89d", "value": "804961db55ba5c190e654e6d23768444", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878856, "uuid": "b29a1e11-a5c7-4d71-a2e4-2c7d864dcd11", "value": "6144:goUn0OWWtfqEJCVMCitwhMo5RwzwsDjm/QKKsjZJhi6MHiBH92FYkpv:goUn0OWWtfwgwh4csG4o7hiBHix4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878856, "uuid": "c51cf5a7-0abc-486a-8f54-259bdaf9e48a", "value": 378880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878856, "uuid": "8711808c-3127-4d88-9a84-8579482729b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878856, "uuid": "4a5993c3-a389-4098-be99-67e6861cd2d3", "value": "b7823e17997deec7ed2340b74ead75de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc76c94-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882905, "uuid": "4dd7cc3e-7264-462b-812f-28208217076a", "comment": "Malware payload (Dridex)", "value": "2151210044a31cbec158f80abd2f9305", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882905, "uuid": "2f06433c-73c8-490f-9f44-7c5b95fe2ca5", "comment": "Malware payload (Dridex)", "value": "9472fdb97c06882c9e683ca35d753c95cbfedd0615c30edb502eccb573f1f3be", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882905, "uuid": "1143d72b-9b0e-4465-a589-7a62f2ea67fa", "comment": "Malware payload (Dridex)", "value": "818bf2933bd6d44e7e698ab3f8ab6b9b58f5c519", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882905, "uuid": "719f5a01-3282-4452-aecf-df4114bd1755", "comment": "Malware payload (Dridex)", "value": "85dcedae1720889647f6b52c50523ce8d0d570899359894429638fe5f035632d4905b0758ab51c841427d2e6ac37bb3a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882905, "uuid": "d38bf345-264a-4b48-9930-d3543fcc6f55", "value": "2F04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882905, "uuid": "0d111f29-cd4d-41e3-9fc9-58febc70e008", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882905, "uuid": "aa782bcf-cb1c-494b-9110-b6c2de8ae08a", "value": "3072:8WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:8WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882905, "uuid": "50ec2ee4-2e43-4a1c-b3ba-b97012c226a3", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882905, "uuid": "e6a78de6-4a91-4ffd-8e17-9aef98280032", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882905, "uuid": "d3a7f3c2-94da-438e-b366-00e9feba4f6c", "value": "21512100_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb23d29-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621853972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853972, "uuid": "13d348a8-891c-412e-97be-1ec14b76ac31", "comment": "Malware payload (AgentTesla)", "value": "62846bf605734b761d6673a9632fd842", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853972, "uuid": "7b22d138-575a-4c5a-bfb5-2573689e9d41", "comment": "Malware payload (AgentTesla)", "value": "94bc59831134405095078442c69093ae2ffad0cb27b2201334ac7f36e53cf61b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853972, "uuid": "38892994-642b-4f0b-a518-c001d8548694", "comment": "Malware payload (AgentTesla)", "value": "3943de907ce0a5ed850d20afe7466ec853353062", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621853972, "uuid": "ed19fd3d-edb7-40e2-a280-1cef2249ca8b", "comment": "Malware payload (AgentTesla)", "value": "5cb188a43d6b5e8628b50809c9e84718a350de7825e470690e5010921ece1cb83e5dea1e41547407e54273677e634632", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853972, "uuid": "97aa06b4-da4e-4a5f-93a8-5448bdcfddf7", "value": "AE25161F2D99E119E1D8C67D46E8402BFF42CBB3203AAED698C7776C0694E41F85162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853972, "uuid": "e5f83337-dcc5-48ec-bd6f-b87303932dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853972, "uuid": "64d19c11-1ec5-412f-8350-d8f0cbd3729f", "value": "24576:BBCeVhlnzBu38nbZ8U+PGEUpiz7tUmMmi0:BBCeVLnNSEZN+PLMi/6gt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621853972, "uuid": "75fdd25a-590b-4f52-ab62-4a148cf0b97a", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621853972, "uuid": "e9d45d55-cf93-42e3-a7f6-24ebf26a632f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621853972, "uuid": "295c567c-2044-4076-b128-cb12405c5439", "value": "SecuriteInfo.com.Scr.Malcodegdn30.3291.15995", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dce1c78-bcd6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621891417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891417, "uuid": "2cf69fa4-f56f-4cd2-8116-1f27be148e91", "comment": "Malware payload", "value": "e2ebb181a9222c8fc0a708e3fdf13122", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891417, "uuid": "7163434a-59e7-4e3f-9c7f-1a60937e1918", "comment": "Malware payload", "value": "954e2edbd28de3c4db4406b5ce638a6347b37ebf9f3cc615db36b8d4bb1f07bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891417, "uuid": "2c67cde2-1f3e-48cd-86ce-90baf94a4567", "comment": "Malware payload", "value": "db593eef84daf20b049691f41a3c3fa44ac7eede", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621891417, "uuid": "248c547d-b697-4a47-b0d3-d4dbf351901b", "comment": "Malware payload", "value": "0cc10a9060cb2a29e1e708006e3ae9e9fdf5e5af17a27ab0dcc9aff2039f87320d2a4d1cfec68724299e9807520475d8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621891417, "uuid": "040301c9-a51b-44ed-9920-7bc6bb9d8904", "value": "E873D0A3F349D85AF5B7D636DA6A41D2BA350D60CB67C2126516F02A0EF32C0870ADDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621891417, "uuid": "d309f6b2-5be6-4bcd-944c-4b2f4e21e1b9", "value": "1536:BHjGV5zwZ5Uzlmq2ra+iQzL14++fuwaKG+4hxj:NjJSmpfiQ3dRhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621891417, "uuid": "2795cc3a-a3fa-43c0-b739-42096b4b158b", "value": 77071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621891417, "uuid": "62ba056a-7d1b-4ae8-81f1-c4d45562dd4a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621891417, "uuid": "13da79fa-dba3-4a53-80dc-0af67f61eacb", "value": "download.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b510246-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1621836062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836062, "uuid": "35b81e2e-35b9-4824-875c-5237010375a0", "comment": "Malware payload (CryptBot)", "value": "cca94ebe2237705c890dc3035d4ab8ec", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836062, "uuid": "074d444d-c3e6-4cfd-84e9-773a97db187c", "comment": "Malware payload (CryptBot)", "value": "957860a901820c6cd66f49700a18a4fc3243104f8147805d1bbec9ec651f009b", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836062, "uuid": "849c83f9-8ecd-4afe-9412-f21b4cc96586", "comment": "Malware payload (CryptBot)", "value": "36efd5c267c1d05db8e7bc0d62af52233d79f833", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836062, "uuid": "db752b5f-f59b-4eb1-9131-8721cf53f4b6", "comment": "Malware payload (CryptBot)", "value": "32ad2d9d7a9fa287e51d5689ee462953948448818cd185dff071d72cd8a438996e8b6dcbe6dafb775450a4310172b763", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836062, "uuid": "03671577-cd7b-49f2-81b8-1637f32d882c", "value": "1D853313B4E0807BDBD1297198ACA6288069E1261726D6DB63C12E4BFD757C2FB353C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836062, "uuid": "7a4abd55-bb50-4711-85d7-579b23d7b86f", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836062, "uuid": "ab56f452-177f-4385-9b6b-3bd6c230c696", "value": "49152:QmMT8vQb2rDCJub2ON99zkKc3SQf/ntcT1QbQwDWXb:QrWQgDCJ89gKc3SE/C+uXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836062, "uuid": "1ab01989-7b57-4c4d-930d-f1050cc57998", "value": 1734531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836062, "uuid": "62d7698b-1f52-4148-a1c6-4edb9098b93f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836062, "uuid": "87058fc6-c466-493a-83cb-2c26d31a4433", "value": "cca94ebe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779a8c8c-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872590, "uuid": "35f153f1-9f5e-449d-8bca-66c94895f9a0", "comment": "Malware payload (AgentTesla)", "value": "edb1a72037615d75f7278def632424bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872590, "uuid": "60942cc1-59ad-48b5-af31-1b547bec8dbb", "comment": "Malware payload (AgentTesla)", "value": "95dc848ddbe95acc3ac77fc7adccae12b8668312b2a932e1c3e80d5a134a20ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872590, "uuid": "9536077f-48c6-4e1e-9086-cd487b87a3f1", "comment": "Malware payload (AgentTesla)", "value": "2a9333b7a6c5b0be7f5593152cfe3a1924ba1bbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872590, "uuid": "a9bc57be-8ddf-4c27-818a-796790d5e86b", "comment": "Malware payload (AgentTesla)", "value": "cd05a6831689d589b4ebc0e45f6cef7e59cde42cfc6be99d7f3bb69ed6baaaa4a4d68eaed4136b6703624953b6e6476d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872590, "uuid": "6b119a10-d591-4796-aa99-59cd96450ebc", "value": "F825171F2E99E119E1D8C63D46F84027FF42CB73203AAED698C777AD0694E41B85162F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872590, "uuid": "923eb497-70c4-48a2-88ed-d5f5a1ed10f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872590, "uuid": "3c412e69-7971-4443-a342-c9cbb200339f", "value": "12288:4/cBCbrGuD9U/rfh1R8oOArSghS2sYoOgyo2Qm7UDmYDFxYR6fPQLE1:ZBCbBGzh3JOao2+2Z7UiYDke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872590, "uuid": "d379a276-0044-4431-beae-67d1b5cf2c5c", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872590, "uuid": "79943adf-6fe2-4398-9be9-083932bc1487", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872590, "uuid": "3b1d928a-ce53-4ec6-b8de-432165a2a469", "value": "Vendor QHSE Questionnaire form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b325a97e-bcd4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890728, "uuid": "e60c122c-ec79-4060-87f0-fc1507ae6c14", "comment": "Malware payload", "value": "303e6db25e07b7b4b7ef4e475dac9148", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890728, "uuid": "aafa8b9f-efc3-4881-954a-edea0b08e4f1", "comment": "Malware payload", "value": "95fd08cb346b2a809eb1e7a7f7ed9982715b1912ba53cbc02833c82db02274f5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890728, "uuid": "e1a36425-d0db-44f5-956f-6df2903c3aea", "comment": "Malware payload", "value": "b6dd1bdbfa6a11f8a6fad41b7125495c5111e93d", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890728, "uuid": "5a181515-4e6f-42e6-9438-f72cd3b38d34", "comment": "Malware payload", "value": "970a13a1787d1070d3dc754b49281f296ec275d65d9de3622b71ab9cc78ddeba306dd07a6495a9e4bf63dea8d17d98ee", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890728, "uuid": "c575f819-8c16-457a-abb2-d3996390e1a2", "value": "FE627D53F16081F2D2F211B8360A4663DAEEBD3CB585883AB7C6090477A04EAFE75343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890728, "uuid": "6683c797-e543-435f-9bfe-70a99bdb0b8c", "value": "d93f0092464fb7dcb459a3aa3707680f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890728, "uuid": "3165d05e-6795-49f9-ba71-0c4949061147", "value": "192:8ehlLy7nEPTXQVrbWftgOs2EKh11kTGFyYhKc5Stqm2KIhxN3ikfoZZP7YQhDodp:lhlLyjWTgRos4h1fFyYbuWhf3yZDF+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890728, "uuid": "8f93e5ec-172d-4007-ab70-3cc031b8b13e", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890728, "uuid": "7a1fd7a7-e757-4f74-bf85-cfb3a30362c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890728, "uuid": "2c568ccc-5a33-44c9-bc8d-c98d72429f0b", "value": "95fd08cb346b2a809eb1e7a7f7ed9982715b1912ba53cbc02833c82db02274f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508e6f54-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825280, "uuid": "62e5c4b8-3859-4f08-afc9-d800a9d2406f", "comment": "Malware payload (Dridex)", "value": "78025743cceab507f14d0b3a3aad5247", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825280, "uuid": "60dcff2a-2b8c-465f-8894-31fbc2358acf", "comment": "Malware payload (Dridex)", "value": "969d6d434a29cf8fa0215b0d82e16fc6244902d4b59547595f766743bcee6b85", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825280, "uuid": "28e3b2dd-b055-443b-81dd-00f28dfe3e3c", "comment": "Malware payload (Dridex)", "value": "0c1f074d862b9cc96cc9565dc584babe715b1245", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825280, "uuid": "8a3dcff5-198b-4340-b0a8-647209759799", "comment": "Malware payload (Dridex)", "value": "875770ab07f52fd30d6bb9d63fd209fca8ae91580cfa39f3aea0bbc22af49111a4991f895a03c57a1b960eea5718a460", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825280, "uuid": "805cb709-605d-4693-8515-c3586ba7a9be", "value": "85F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825280, "uuid": "f0bf73df-8b7a-4364-aa04-3ef6c67453fc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825280, "uuid": "7c1fa84a-1797-4c3c-8955-8b78d2d0088a", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825280, "uuid": "8504d8aa-0917-4976-b446-7ff7cec2f32d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825280, "uuid": "67a14311-a7a9-4903-b1a6-ab4253799555", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825280, "uuid": "d31bc198-f999-4c70-9dc2-1140008c913e", "value": "78025743_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bdf68ae-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621871308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871308, "uuid": "b5737efd-0473-43e1-a4bb-da7c7345dd68", "comment": "Malware payload", "value": "f89e31ef7790f539c3a71831dc9d794f", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871308, "uuid": "220262e4-ba5f-4692-89f3-25569c8b826f", "comment": "Malware payload", "value": "96ccf0b030c329c696c5ef066c5ec0e905458e98012aa065178ad589a6f674e2", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871308, "uuid": "274f3f0c-9852-409a-bce7-e6244661495d", "comment": "Malware payload", "value": "edc83c80bb7807f461add5738768103905d3d81b", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871308, "uuid": "7643cf29-44c1-44a7-b21a-2a75e4e29794", "comment": "Malware payload", "value": "ce2a783acb015b62d055700df38884329a7397f59d292171fb01e8a72786beaa1d10708db2ccf6e7b03ff48f333c3eb2", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871308, "uuid": "9f741964-811e-4262-88ed-3fa9fee5e5a5", "value": "B015D59C366075DEC46BCD728AA82CA4EA20347B5B1FC207901715EE9A1DB97CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871308, "uuid": "5cc5d7d9-41c1-4d36-85c6-c9798c6b0c42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871308, "uuid": "dabf526d-554f-47b9-a347-c2fb659441a1", "value": "12288:J8Ia+eAL6luM2yN2AGLdcJu2m3vSWBI9VomUv+waC94xSUwYly7A09QlSCnpb24c:9uZNoeY2PWRmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871308, "uuid": "c48fa7ab-2f68-409f-be6c-6c23d1a35357", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871308, "uuid": "5ac7676d-b7a6-44f6-bc92-fa0a451de81a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871308, "uuid": "4e34011e-4cb1-4406-adec-b35b339fc46f", "value": "Copia de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0517a3-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839767, "uuid": "ff2a0bcd-0010-4e9a-b285-193793dfd643", "comment": "Malware payload (Dridex)", "value": "86860137b83a83b39e98053c769a123f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839767, "uuid": "7c982a55-ae75-4f3a-b8bb-96ed0ff94e85", "comment": "Malware payload (Dridex)", "value": "96f4139c868be2570775f435f60e4d7e328b1c77fef17334cda9b113523f001f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839767, "uuid": "72594581-0891-4e36-bf99-c926a1717851", "comment": "Malware payload (Dridex)", "value": "577f6c64bc7d07fe440491239b866df3744a4eb2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839767, "uuid": "4240f417-11fe-4cfc-9e57-33c649e06c07", "comment": "Malware payload (Dridex)", "value": "8b5bbf8a0d0da0e120f15487ed021e5a597f4129b3a34817e3ea3a47d02ea5d9b0e359f086adb91b82a165a89935e9e7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839767, "uuid": "d309f97f-f251-4893-91ff-31cb9f416c35", "value": "90F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839767, "uuid": "da84ace1-2770-4cf7-b937-bfd2e2c2deb5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839767, "uuid": "a5b9ef92-af64-4039-b746-996612112348", "value": "3072:bmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:KLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839767, "uuid": "9488591c-ed4a-43c4-901c-461790127efd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839767, "uuid": "3befa9a6-4b2f-4532-b804-39c00bd87837", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839767, "uuid": "029b5bf2-0392-4b84-9fab-dac93c07b119", "value": "86860137_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e56abe3-bc53-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621835181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835181, "uuid": "b995baa7-0c24-4d05-8e9f-a89d18381016", "comment": "Malware payload (Formbook)", "value": "e57ca51e0a429088a5735bd9978aee98", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835181, "uuid": "d37213a0-41df-4b01-8ba7-17df60f36785", "comment": "Malware payload (Formbook)", "value": "97451a8bf2551e89239489a6e8d8dce8cbc3348468d4a0d007894d0cf6c85ca9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835181, "uuid": "df4b0ffd-6e80-4214-ad8f-b24616e92afc", "comment": "Malware payload (Formbook)", "value": "55066a0cf75412ffc5b2eb4cde80aedd8340c116", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835181, "uuid": "e55e7181-560d-4c62-8492-23f78c61376f", "comment": "Malware payload (Formbook)", "value": "728a47b30687be1d3544b58e7663dec656f7e5790df652048bafcbcfa740a7331b1fdcd92079bd16d98d1dee2f256c85", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835181, "uuid": "5b6d13e5-faa3-4a1f-8d30-244222f637d4", "value": "EA2423B15CE46CEE0F4EED1D0EEEFDA8E24185EB88ACF9A119F790584ACD6360444B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835181, "uuid": "ebebb9b6-88ea-4779-8be3-fcbc800e294c", "value": "6144:uQtX96xqhKgRfpdcH7Y4zo8ne6uChX+RpVB35yvn:uQtt6x0Kp7e6B1+tB3Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621835181, "uuid": "6475ff8d-06b3-45d8-9c24-88d2add1b949", "value": 222754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621835181, "uuid": "7804c36d-55a6-4ccf-af91-f66cb4efe66d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835181, "uuid": "8227069e-d2cb-4a54-b1c1-562fd4b18044", "value": "Scan0COPY0002.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afae8d8-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825324, "uuid": "45e67f28-a5be-46ae-8799-0cd35711b2e5", "comment": "Malware payload (Dridex)", "value": "0a500e998da1e9e9bb28f54882d43d34", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825324, "uuid": "0e3731f3-a3f5-41c1-805e-b5e15d3f1b28", "comment": "Malware payload (Dridex)", "value": "976c2012822acc2265af8f62a37cc05d096e2e383a882cac3f6755066382de24", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825324, "uuid": "f9704c35-78c3-414b-9ded-3761ea6b700b", "comment": "Malware payload (Dridex)", "value": "db8501848f7a1225447a285c007874cc21acf157", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825324, "uuid": "1e64e2ef-9bad-46ec-96eb-32eb3aece105", "comment": "Malware payload (Dridex)", "value": "df567ddf08c80f7f689077ea87bfc8c86d2d5841a33bd90960e06eadab3f61d08be8e496d1e52413fab6b27754514636", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825324, "uuid": "4ec70f5b-766a-4863-9d9f-bbf02425e1b6", "value": "67F3D0D3E21FD2A4F223063450F4F46ABA7C24C746349E14C5518EBDA1DBF39E16BA26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825324, "uuid": "1d18a97e-fb31-43d1-bd50-0ceb713d9913", "value": "88962f6760ea005847fb88b87e8ce1fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825324, "uuid": "f71a260c-41f6-4818-8342-5a1bc5147158", "value": "3072:b9F/oNrQb4xVubbXP/NTccbsFvCeLmXH57V30e8Pj:b9F6rQXvFczvYpQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825324, "uuid": "ff2e3eed-b270-4b35-ba4b-173097830bb8", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825324, "uuid": "8e5c913d-bdcd-4dfa-a8d0-8a043534ff86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825324, "uuid": "7444f75e-e8a9-47b6-a035-d6bde203b10c", "value": "0a500e99_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af10a5a5-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857650, "uuid": "5c6ef6b8-a5d4-4eb4-b117-8d17c8dcd0cf", "comment": "Malware payload (Dridex)", "value": "1a4c44d7e7af56810838d09bced92120", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857650, "uuid": "7abbfda2-a12d-43b8-8dc3-2dcd2d91584e", "comment": "Malware payload (Dridex)", "value": "97704efd0e391d21983cb643629f407cf2a0c8874482d1df9fa5e85bf98baeb3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857650, "uuid": "8b2a6d89-6134-4ce6-b93e-b3812db08c0c", "comment": "Malware payload (Dridex)", "value": "2c948e2927d4036f8f9871374b271db2e65d468d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857650, "uuid": "97d65ca2-dd14-4743-a5bf-d63945fe6023", "comment": "Malware payload (Dridex)", "value": "bab760310a59110b89140282abeb6d47d1f862ca642e17a35e0cb52f289e4a4f3a24e66be2e0b8d2be008416254350ab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857650, "uuid": "65b948c0-47cc-4390-bb79-9fa2ab8f0aa0", "value": "6904B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857650, "uuid": "a3af1a4c-33ae-475f-b42f-197e69bc2524", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857650, "uuid": "ae5d87ca-efa4-4cca-b883-948a7cd9c70e", "value": "3072:ZWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:ZWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857650, "uuid": "4a151ce7-b5d4-462c-b755-94ab1e6655dc", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857650, "uuid": "cad4fc07-1854-482c-a9a6-bd37be47a01d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857650, "uuid": "b71724c8-203e-408f-a427-069dfb053e5b", "value": "1a4c44d7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf1e7b5-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890045, "uuid": "ffd3610b-a259-4ca3-b293-c5304f424eb1", "comment": "Malware payload", "value": "f10739f86fc8ab2f9a7b4209ea9ac495", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890045, "uuid": "62730174-5314-46d5-afb9-e44816415095", "comment": "Malware payload", "value": "97b13d544d545451b6386f52306be0e1ba45b3daf1e8969fd4eefa4798dba03a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890045, "uuid": "42cad1f0-dfcb-4109-a05d-4b40bf964e92", "comment": "Malware payload", "value": "250e046eff9ae7195e7279fb133f21ed9b65aa88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890045, "uuid": "8e16e3d5-d32c-4985-b7d1-fba16ae5276f", "comment": "Malware payload", "value": "6925a1e998fe55a6fd875243fbd609dfec612827c700c29689f9cdb4cf414216688e377649843b48684106b2942d0a37", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890045, "uuid": "2d0492b9-df23-4853-9c87-191cee4f891b", "value": "02F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890045, "uuid": "f49a69e3-b1ad-47f1-a2de-2728a6b26f2b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890045, "uuid": "c4ebc6b3-ae02-4ae0-ab0d-fcb946b591ae", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890045, "uuid": "9352d829-eee9-497c-8824-2cb617bb047f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890045, "uuid": "0691cd83-98e6-4400-9569-b88cc3ea4299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890045, "uuid": "e491fc13-f1ea-4a33-ad84-2ea24ab994cc", "value": "f10739f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2afc9ad0-bc9f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621867737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867737, "uuid": "f2a9a03b-57bc-40ef-b846-1d86cf9e7318", "comment": "Malware payload", "value": "f5b1649203c62fadcd4e3f0da6793e45", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867737, "uuid": "f534226f-5a45-4b1f-a192-8a895df84e05", "comment": "Malware payload", "value": "97cc34a482565accb91e660ff2bb391ffc760517e4e3990827e6eb519943bd6b", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867737, "uuid": "35bb4520-5c42-42e5-bd26-e650f728c3d3", "comment": "Malware payload", "value": "b2dd350901e0a37ae04a69335a682a05e09975fe", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867737, "uuid": "f99bba8c-f606-44e1-af6f-1a83dacc8345", "comment": "Malware payload", "value": "31ab540b37a8c76c27f59cd1606af782f80be110b848ae868f4052495fb902084aa7ccc9611193cbe44d1b8ac4a35b38", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867737, "uuid": "c0458af0-9d09-48fa-aaf6-8cd565b236c7", "value": "03059E69719071DEC46BCE328E28DC7097133CA65203E217A1D77C9FBA2D2978E255E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867737, "uuid": "1616a28c-ebcb-4e68-8efe-a666c4c33599", "value": "24576:JHFBkJU9L/2tWzmipcqkn5/qqsMI/4Ad++++4+++++++0+++++++x:rVL/eWhcqi97xQ++++4+++++++0++++g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867737, "uuid": "8c80f21c-f3b0-441d-9ad9-292a949a4429", "value": 822574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867737, "uuid": "88c5e761-0365-49d6-8e5e-c0b66ac20c75", "value": "application/x-ms-wim", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867737, "uuid": "eb483679-6215-4867-9f2b-80dc41ff1f11", "value": "DHL_Ningbo - Invoices - Past Due.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "901aa78a-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893676, "uuid": "6cd67a96-378a-4d7e-a03a-7e23eb102f52", "comment": "Malware payload", "value": "ad13cb1ca2bdca497f791c94c488f792", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893676, "uuid": "895ab49f-f690-48c5-a1f1-1bd611d0d3c0", "comment": "Malware payload", "value": "983064a0d0b3ad07f3063d829963bcde7d3905398d4447d9725bb39227ba7347", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893676, "uuid": "cc33cf21-b107-4a73-a5d8-9a39ba046e85", "comment": "Malware payload", "value": "db3154a6011b23a2ca0f2981c72572535f1d80b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893676, "uuid": "34b5e5cc-7858-466c-921c-d804d593b4fc", "comment": "Malware payload", "value": "4400fd83ed48db7861c24a65c6c4113ca8060f65b207fef0cfff9fc5ca6e83f6b13d6f05f36f6204938606f9f4c44045", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893676, "uuid": "6475278b-6b52-4364-a6a2-261d776428d6", "value": "59F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893676, "uuid": "8e41e1d9-9053-4a0c-9bde-a7c1849201be", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893676, "uuid": "f9c7c58c-a81f-4a64-8ad2-ccd7e3802ccb", "value": "3072:ImNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:RLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893676, "uuid": "813695ca-0226-4d3f-ae0e-07f7f980e6c5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893676, "uuid": "fb90b1f1-1e72-49df-ac67-f6f3938ded9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893676, "uuid": "34548d96-951f-477f-9b65-23dbb4577313", "value": "ad13cb1c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fd4f92-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621872954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872954, "uuid": "13a13743-19cb-47de-9457-bbb629e555a3", "comment": "Malware payload (SnakeKeylogger)", "value": "3875cf690acb9e8a404307192dd53b67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872954, "uuid": "4648ba22-78be-419c-af85-ce3fa1a65cfe", "comment": "Malware payload (SnakeKeylogger)", "value": "985b17007b348e28aad6bc28f151c9ebf33f79d3ebbc627168b8b0291e95b6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872954, "uuid": "4df093cf-283f-46b7-b0f6-06b9133fb3c9", "comment": "Malware payload (SnakeKeylogger)", "value": "bce5711ce28c56e63c223d12d6ed2a61bea8cdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872954, "uuid": "f5866eaf-b56e-4db4-81a5-a796f45458ad", "comment": "Malware payload (SnakeKeylogger)", "value": "548286b97035e69cb35a66964133d20240a1f84d27469fb729653817363409315ee550631a5c058b5cd616d3d9a8e86e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872954, "uuid": "f180bb02-7c3a-409a-af77-3198e0f0e75a", "value": "A545F52DA206E080F15DD0B1CAD0BAF7D402EF3BD5262D1795C73F81323AE567A6A15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872954, "uuid": "454e2d40-44f7-4fd0-9066-3e021b81e47a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872954, "uuid": "e1879573-948e-4efe-8a06-92bab0c461c6", "value": "12288:2ct5BCDxtsXcmfFD48zO1f2ApY32u0B3UmTQj8aloW6B6CJMAb5n01:B5BCDRS4v1prpBET3o9Bd7V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872954, "uuid": "a3599855-f335-4425-a565-f17e5c89484e", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872954, "uuid": "0436f337-613a-447d-a0c0-de13aa20d92f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872954, "uuid": "ebca2006-1177-432e-8945-3bddca467d7e", "value": "SALES AGENTDISTRIBUTOR AGREEMENT FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82d37ed0-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818062, "uuid": "68557dcc-915e-4f0a-8499-f2ca41fd5053", "comment": "Malware payload (Dridex)", "value": "d9b904c52db84c55d5e178b312884938", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818062, "uuid": "ee25d569-4ad9-4b8f-ac99-06a75bed8ccc", "comment": "Malware payload (Dridex)", "value": "9866e55576fc40af26ff7211494bc0810216839c354f15f1e498852e4b850aea", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818062, "uuid": "12699ff6-88e0-4d88-a3a9-fe7fd310ea9e", "comment": "Malware payload (Dridex)", "value": "79dc664b1508090e5879811be579c817aa52d4b7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818062, "uuid": "a3bb5020-313d-400b-8cc9-8a4109a0395a", "comment": "Malware payload (Dridex)", "value": "738799ce9b7a9ffe1f026311b1b1fe028198d98f167ccd2e29c4dea4e7b66a94eff5d26fd772431d2e45f7f8678e2eea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818062, "uuid": "ad9b1917-1d43-44b9-a7a4-6de64d92a9f4", "value": "54F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818062, "uuid": "57839645-cdf3-4c5c-86eb-eeedaafa89bf", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818062, "uuid": "4146eb88-57bf-4b27-981f-517391d3791d", "value": "3072:TiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:weAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818062, "uuid": "b508e6e1-e6c2-40db-bc57-4f98f1c687b9", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818062, "uuid": "4ce04745-8dce-46a3-9a10-8c5b2c6eaa1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818062, "uuid": "14010c2a-f74e-4202-9788-cce06a16b0b7", "value": "d9b904c5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f92dd4a-bcd4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890669, "uuid": "4a559099-a3a7-4d88-b003-4bc07789817c", "comment": "Malware payload", "value": "e064ea4a9dda9501594c8b7655910aee", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890669, "uuid": "2363b6b4-739d-44c0-a000-78c934fc08ac", "comment": "Malware payload", "value": "98eb81977185c57fbc501784c25cc9f601091c96d536f66287449455fb2cc349", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890669, "uuid": "411d77be-d751-4970-b24e-33442d5e3775", "comment": "Malware payload", "value": "fd95b99138a76b53ea39489c3f8abcaaf7164523", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890669, "uuid": "e5d03396-e62b-4d86-bdbb-fce0b2c92564", "comment": "Malware payload", "value": "e0a8e6cb108915ff2bb5cf4e96a22a78e26bb29c2a65fa1387d3e101c2c3a07b7217286ca556e66a1e3ecb30522f92b8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890669, "uuid": "a506fb78-02b1-448c-9bb7-98c2dee731ee", "value": "03B3E097D311F466D56783B2CA3945E336380EB9DB8186270605707E0EF2FC99A8ACCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890669, "uuid": "5f9bca7e-125c-4fee-9b69-36aff81f1645", "value": "1536:+r8FUmkGjjiNmVEelffWR4JyBBXHEJ5Q11n/7O9d8viPclM61Tf7Z3/d:+r87P8mPlffWR4JyH11Qd8oeM61TlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890669, "uuid": "f5180d78-92b8-4061-8cdd-c1aa759569c7", "value": 108012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890669, "uuid": "14307eff-2fe1-4bfb-9532-c0e40ce19734", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890669, "uuid": "e35bb6b2-5666-4aa5-9c79-3922edbd6352", "value": "Btccoin.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09357e9b-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868539, "uuid": "1f7b8b3b-6ff1-4b9e-9215-0c576fa3c062", "comment": "Malware payload (Dridex)", "value": "ec81c1bb9d1b5152bd18e2d4d634f1a0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868539, "uuid": "90b16f52-3c1b-4e86-801c-0d0fad0cc664", "comment": "Malware payload (Dridex)", "value": "99642d37b1f16d8b833ae3207eed2988633b052e61a1f93cb3ae5feb556e2b25", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868539, "uuid": "24a72421-25f6-4c25-bcb8-14f96dfab280", "comment": "Malware payload (Dridex)", "value": "2b1827d3ddbe4a111c5c5ccb1985c200718da851", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868539, "uuid": "c64803d9-2f21-410a-9104-46d8078c77bf", "comment": "Malware payload (Dridex)", "value": "cc4bfbcffc263b95b73414423c550165ea0fc048e1bbb38447066e01df40e1231ffe04ddf7934d89b5a4676d303a21a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868539, "uuid": "2e8efef7-c994-4cdf-83f1-3a8b9af35abe", "value": "86F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868539, "uuid": "80fccb3a-73d8-484f-890c-6681b09f0578", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868539, "uuid": "5188919b-9604-4983-8005-6d9680d46096", "value": "3072:xlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:xlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868539, "uuid": "5a59669d-026e-4a10-bb22-e435bfc24794", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868539, "uuid": "3db38810-1d17-4a1b-b6e6-841034796fce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868539, "uuid": "dce2d149-1d1c-474f-b58c-fc7ccdf6490b", "value": "ec81c1bb_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d189bc8d-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621865010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865010, "uuid": "a18a4b91-d89c-4288-b803-889521fb7d1c", "comment": "Malware payload (AgentTesla)", "value": "0d7d397b6df9fd4361091e2b2b685085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865010, "uuid": "d8c11517-ce1a-44fa-8335-79600a3f322e", "comment": "Malware payload (AgentTesla)", "value": "996872584e3d5314e62439ed80748b3cb4896b29e251aa56903d17475d3e10fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865010, "uuid": "9f846d48-b940-46e3-853f-0a363cfff098", "comment": "Malware payload (AgentTesla)", "value": "af47c111a4b81a1ce19d573f28f5af8f657a2677", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865010, "uuid": "83f0b09c-bd6a-4792-9579-f9b31e78ba9b", "comment": "Malware payload (AgentTesla)", "value": "e69fa99246f770d79596f62d3d87d93edb24971b77b6beb200d262560bb73db46c90edcc95187f3975a5e9bb7283c22a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865010, "uuid": "7936f7df-6cde-4d90-82d8-32610ab179b1", "value": "2D15592C146AF126D6A8C2794AD4403BE591DF373132BD59E8D33F587739E80B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865010, "uuid": "f2feb011-e361-4bc6-9b8e-0fc71f5baa26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865010, "uuid": "e3cf1557-0b34-4439-b9da-6f4ecb5b2657", "value": "12288:t2gBCg8ctVoHS4R4ennGxwY7mHRKDDAq4LKNjd7WeGruwaYpU+rEvQiaZVy32:HBCgUVrnG6Y7nDyL+1i1aYpU+rEkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865010, "uuid": "9e113438-7c9a-409e-a713-8752ae412071", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865010, "uuid": "20b4cf0b-c9fe-47f1-b60a-b843caaf2d45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865010, "uuid": "8b7a2837-ef07-4960-9276-4974cbb8aef4", "value": "0d7d397b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11773efd-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832475, "uuid": "a1fe9d9d-0ae7-4fee-944a-d4ed9f72c5d3", "comment": "Malware payload (Dridex)", "value": "29b848216d3932aef12295c2b0e9556e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832475, "uuid": "9a7a6c0c-b75c-4d29-bf5d-cf5adcbaa694", "comment": "Malware payload (Dridex)", "value": "9a5c94a368da6634ebbf8ce43fbcc86961d9bbd34668a5daa2a7c16505a632b4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832475, "uuid": "50916cdc-7976-4624-ac70-f19841ee046c", "comment": "Malware payload (Dridex)", "value": "100cfb5f46f859c5ae556f0c421423b54a0b010e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832475, "uuid": "aa8cc82c-bfff-4201-993f-9a96ce5255b0", "comment": "Malware payload (Dridex)", "value": "ff1eecbaeed356ccc935790e19f356856e864c624adf2d05cd6d838059c4f0716c8b555c3515fe9e7c3a5ecd2ff60956", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832475, "uuid": "16e1e86f-65b1-411a-9c55-4a3aa58dbf56", "value": "DCF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832475, "uuid": "d5fa1f5f-c738-4214-8a17-271ba703e973", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832475, "uuid": "24e281cd-eebc-4886-929c-4bf4b96a9679", "value": "3072:LIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832475, "uuid": "9cd0004f-a210-472d-9c1b-752eda5b053e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832475, "uuid": "4b44d2c3-2552-4f0c-ba7a-2e070eda17f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832475, "uuid": "94516909-1e1b-41d0-ac64-fac1b40d34bb", "value": "29b84821_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750a996c-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825341, "uuid": "2ecf702c-dc5a-441b-ad73-9d0d3355f371", "comment": "Malware payload (Dridex)", "value": "82625c41fcee3aa2e3b39c6fe3595cce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825341, "uuid": "85eeece1-3504-49ad-b4d4-33ae766d39fa", "comment": "Malware payload (Dridex)", "value": "9a9576bb95a8751e9a672f4dfa4084ae5810896d400dcf8b73bbaf7d02cde9de", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825341, "uuid": "1db2051e-5e9f-4a96-a89b-d178b0535f6a", "comment": "Malware payload (Dridex)", "value": "0e78d0d436194ee2d32f948610124a29a1bee585", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825341, "uuid": "a87c23e2-06ba-416d-a386-b9e884ae5ef9", "comment": "Malware payload (Dridex)", "value": "209b09b6a5439c8858e7a60221fc6521ba2162143033b445e0409f7fc2343c17b1164dfcbca11034ddcc4a60a8e9efed", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825341, "uuid": "76b39f72-63d6-4de2-b237-1390b24f6574", "value": "7F04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825341, "uuid": "3ebcf6be-a9c1-41e6-9979-3cfb5f6c64df", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825341, "uuid": "97e29fce-aa75-4dd4-adfe-36477950a5c0", "value": "3072:cV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:cV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825341, "uuid": "24366ead-dc29-43bd-81ff-963d797115af", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825341, "uuid": "447a51c5-776f-4cda-a15c-a6d1a5eb8016", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825341, "uuid": "efa9de7d-1614-427f-9c09-247d60188194", "value": "82625c41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66181151-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "1f6b1249-c694-4ab8-b023-110a97bb2ca9", "comment": "Malware payload (Dridex)", "value": "6751a025564fd70a0e4049e4fbf3f55e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "dbbb0586-bbc5-4d69-92ff-d28803c30cdb", "comment": "Malware payload (Dridex)", "value": "9aab6bef8191b9f7e681ddbd98711ee16ab9fb07b9b929066a0e745a4bbf5905", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "879b3167-f118-4fe7-b40a-4aaaf4eeb636", "comment": "Malware payload (Dridex)", "value": "8b7541ab2cd2da3f98dcc9bdf1d65f2601f5d118", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "1e32ce65-5882-422a-8c8b-96300f157a04", "comment": "Malware payload (Dridex)", "value": "0db1e36ef1f9c27284dd97dfcf48da566ef8cda28497dd69913e4134563e8725520c19670f2712a215dd790e06e5090d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "51fd2b55-d05f-4279-8d80-4046f021dd1f", "value": "5EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "c8abc26a-479b-42dd-9f59-c15421876a2f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "62a907ef-4375-414e-b1ca-aa677c8c8856", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836053, "uuid": "9dd9a972-94b0-4636-8915-34b45d25f1b4", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836053, "uuid": "88c47763-bf95-45b9-8fdb-2f4899a6cc41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "c9d4166d-8a52-4f8f-b40c-559be02d3cfa", "value": "6751a025_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859ba50d-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1621864882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864882, "uuid": "8ede0cd1-8c80-4633-b6f9-426c2cee67de", "comment": "Malware payload (AveMariaRAT)", "value": "571ebed5abb3a91ca36de366f77cc888", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864882, "uuid": "5245357d-2c90-4cef-b76a-93be2e9bc145", "comment": "Malware payload (AveMariaRAT)", "value": "9b4055863b5fddea27dac8436cb4561c182c2ae4662780615eb3079a67011bcf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864882, "uuid": "51ff224f-ebb5-4bbd-8dad-8f40944dea57", "comment": "Malware payload (AveMariaRAT)", "value": "ec6764b5d61d2788a720ade51a72bb8f2cda9d68", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864882, "uuid": "e719d75e-8e78-45bb-98f5-ecc8738206a3", "comment": "Malware payload (AveMariaRAT)", "value": "df55721804864d7bf24df6a344f2fa3172ae26daead39d6fb6cc3832e47a2d6430a16fcbf92d601201fb8d342be44a1d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864882, "uuid": "f616be9d-a876-46c7-96c3-8bd505dc5ab8", "value": "69D423655697992FEFE07DA72A520D8873277CC0B2975F84CF66AE9A0883E37045D30C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864882, "uuid": "d65aad42-5c5b-4dbe-aa7f-eff93fbceaae", "value": "12288:Wj9c9qrTHyv+PONkuiSEpjLK31/5oOsFcwDMQFWO2xD5ztWFONs:sWofyvoNuwL4zHEDnl2xz1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864882, "uuid": "dc265536-1841-4c14-b460-1e9ca7e48fb7", "value": 654445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864882, "uuid": "59ae311f-a6fa-495e-b375-4a0b5ac14bdd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864882, "uuid": "ac693ebe-bd3a-49e9-803b-6806d8687ec5", "value": "571ebed5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e929ee-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882952, "uuid": "ed456d1b-4e52-4533-8268-be8c4ccc712b", "comment": "Malware payload (Dridex)", "value": "f6a09a166b05e492394a53eeee0a374c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882952, "uuid": "f31a0a2d-3346-4e0c-ac90-0d9cb23976b2", "comment": "Malware payload (Dridex)", "value": "9b4c105a9b94a1ff9bfd03ee3ea249ea7a2432bc2ae6175750679fa543363fb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882952, "uuid": "31224b37-16e9-46bc-8cd8-01f5ff0a9142", "comment": "Malware payload (Dridex)", "value": "126eeff2e61641af776377bb8d5ed5922358a0e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882952, "uuid": "74d159dc-ae46-44c5-8ec2-d994413eca27", "comment": "Malware payload (Dridex)", "value": "7fb9af24c802374ab5f2419130ff8b024a0f2f4f31f00fb7fa4fe6af5ec40f2f17ecdb3bc17d2abda73b14bd74eb4f83", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882952, "uuid": "0a620bf4-d36a-4bb6-897a-4fc180e4e9e0", "value": "B8F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882952, "uuid": "d1de4594-98ea-49c6-b734-03f2f2aaef77", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882952, "uuid": "d3192573-e329-46d7-a6fb-45582467c7d3", "value": "3072:4IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:xc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882952, "uuid": "a75f32dd-9f1d-495b-9c82-f25785d13cae", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882952, "uuid": "ecfd636c-6a80-441f-b2cd-e4015cfb076c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882952, "uuid": "7c5cf291-bbad-4bc1-a8ef-e17f0fa78554", "value": "f6a09a16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0177b62c-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868526, "uuid": "e0faf310-3e67-4287-b199-b73b611d6dda", "comment": "Malware payload (Dridex)", "value": "cd25d8e88a6b32577e70eeb2f214725e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868526, "uuid": "2cccce7b-04e2-4fc8-a18a-a958a2a79fda", "comment": "Malware payload (Dridex)", "value": "9bb8ea8962e1024635920c41e253950b0b71663ea1eb3a959ae212cfc6c74ad0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868526, "uuid": "7d9685fd-487d-44cb-bdb1-9dff53c4605c", "comment": "Malware payload (Dridex)", "value": "c44155fdd703b383c280a0901c59795e47ba8be7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868526, "uuid": "149e8b2b-1fce-4286-83f6-70b724a03d2b", "comment": "Malware payload (Dridex)", "value": "6da25f2e09296e90eac7e9d436f7bcb840cd3e61c035dd59eef516162d4888c8f578fb64fab94f73b6249d532c2602d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868526, "uuid": "d1ea9af4-dfa2-48ac-9bab-6b74f1854760", "value": "B0F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868526, "uuid": "5b2ae0bd-4f17-4bfe-b8aa-8b093a94eefe", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868526, "uuid": "905fb2ab-99c5-46f6-a71c-38b9b6a6a2c8", "value": "3072:1mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ULc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868526, "uuid": "b4fc8aef-2187-49be-9897-ce66f2448c8b", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868526, "uuid": "2d63c7e3-281f-4752-be8d-5e1a97c603ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868526, "uuid": "98eef0a0-9922-41e8-bd63-8495c37f314f", "value": "cd25d8e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e819b4ca-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897260, "uuid": "8aa2e689-573e-4646-b72d-407693a626cb", "comment": "Malware payload", "value": "e5dccf7fc912d066e4f4ec80991309c0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897260, "uuid": "cd8e44e5-c3d4-473a-ab98-4dee30fb537c", "comment": "Malware payload", "value": "9bbef1c1b63c25c15532dc0c45345df120cc5ca7e23d3778d17bcbd23219a1a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897260, "uuid": "b46178ba-476a-4ef3-829c-d182eabc70f0", "comment": "Malware payload", "value": "c125108c3439dd7422088e19c5ae3db08f0353b8", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897260, "uuid": "d1545da1-ade1-44ba-ba1a-f7f208c0ba79", "comment": "Malware payload", "value": "b98f944ee3e2756f24093b84e856dab192f9904ae433f48240f6df4361a3f9c7e91a6038f42d5344e55cc415841dd1be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897260, "uuid": "f6750cb7-b8de-4325-a702-b03e3c5beea0", "value": "20F3E00AED9FE988E85C51F1CA4D363EE9713E361B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897260, "uuid": "234e3164-646b-4633-88c8-31034614d544", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897260, "uuid": "dd396cc2-c33e-4387-8916-9d0e6d714728", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897260, "uuid": "b1d5bb3c-468a-451b-9ecc-7a5f7d9f3e68", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897260, "uuid": "bd85042a-8998-4801-8992-327d72b1f50b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897260, "uuid": "bc0c93b3-b905-4448-bbb1-3f9f7b582b92", "value": "e5dccf7f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aad442e-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850637, "uuid": "75356c82-0e56-4202-8440-d7eb910a0939", "comment": "Malware payload (AgentTesla)", "value": "7ebc4f805ddf9e73b25985141a9e0c24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850637, "uuid": "c40adf79-9702-489c-84d6-b0bfc7b1b543", "comment": "Malware payload (AgentTesla)", "value": "9bd574f642942674fbd1dc228521251d23f9c02e0db08ba1346c58a0c48664df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850637, "uuid": "8afe2b63-f54d-4c4b-a1fb-00b897ac7d8a", "comment": "Malware payload (AgentTesla)", "value": "143af69a48112e00f71a3ede658c2e0d78051b6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850637, "uuid": "b9cc1db4-6dd7-43b8-a822-bd89e43cced4", "comment": "Malware payload (AgentTesla)", "value": "010c508ba4631ad36f8ff1f373b9eba1bcf671b44a3f9b0229256ba8328e5627205a2bcede4edff7a8223ab2b1842c62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850637, "uuid": "7c5add40-7648-4c49-a859-2b22cae07666", "value": "3CD4233F3384695F6AC233BF8F55BE41B40194117E778BA7AD8CA187C516B3B871A089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850637, "uuid": "2af929cb-cdae-47c5-a338-0a1a96da0bbe", "value": "12288:3vcEZYLw0TbgiG+AQHBeBbNDN9d9JCEDdHkfy5jyWPjrxZm+bedyy8ORmPFV:f5YL3Tbgv+dheBbNDbd9JCEhjjZjradu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850637, "uuid": "e4311ff2-4ea4-402a-85f4-76266a1c9c47", "value": 619818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850637, "uuid": "2ea24887-0d7c-43e2-b30c-e18062e189f4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850637, "uuid": "cfc077bd-1360-4578-9566-987d93d48822", "value": "Quotation 60584.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba973e56-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621886446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886446, "uuid": "8f862215-a871-453d-bf94-5e80d7943807", "comment": "Malware payload (Quakbot)", "value": "a034c8ec8d99af09997cfa044fd7941b", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886446, "uuid": "ffe27815-869e-4d2d-a13e-9bd2f45e4453", "comment": "Malware payload (Quakbot)", "value": "9c0d63c8ba5b8144833ff9dfc05ed0d2b71eeefc311a3231299fdfb01d75d098", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886446, "uuid": "10d2e608-5924-47f3-a30c-4bfb7dc3f3f6", "comment": "Malware payload (Quakbot)", "value": "6957f225b6609b3a3f9744e992442822dfe20d2c", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886446, "uuid": "41660440-3a73-471f-b50c-48b5608befd8", "comment": "Malware payload (Quakbot)", "value": "6417327bbb23bdb09c8068df28284ddeb0c6f105889ffef6928a5cc984d866d31bf74223dde9e1ea2a1e055259e493b9", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886446, "uuid": "964f7897-a74b-4845-8f23-29e834dcfeb2", "value": "1F84F26377CEC006FBAB0F3EB5279A1045F5AD572473867A11D035A8F9B2A3008D6B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886446, "uuid": "0655a0f6-d954-47e0-992c-90dace5c58c1", "value": "88d1baac157ea158bb0b90cc43e63e8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886446, "uuid": "c86eb8bc-2a7b-4ab7-a74d-d440306d045f", "value": "6144:6z4d4LL71s2EuhNJxwNNSL3KBTN1phwn0:vWLL7WZANfwa7YTN1phN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886446, "uuid": "93bad3ab-9df5-45e1-b958-40757f8ece10", "value": 384944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886446, "uuid": "50fbf069-bc2a-4c47-8af6-5753a05ca82f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886446, "uuid": "cca76206-00c7-4192-bf50-66efa14c0048", "value": "a034c8ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bfa35f-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897226, "uuid": "dacd4a2d-29e8-42ad-9705-06fe4ce3593c", "comment": "Malware payload", "value": "b214a80672ebd479f79e227faca1bf21", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897226, "uuid": "9489e7a8-2c7a-4c67-ba3c-f4ecce844a8d", "comment": "Malware payload", "value": "9c2bc770db06becec4b818858a55d5575a0de6e64ccd36a5c69148ef23ba690f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897226, "uuid": "c1bc51ae-07d3-49d8-a18f-e434f9339dc6", "comment": "Malware payload", "value": "be60a5eee67fbedb26d4b2d0e58602f8d4c8c02c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897226, "uuid": "2265217f-2ae8-4772-8d3b-46f3090f2837", "comment": "Malware payload", "value": "4ea2ee85861778d5c794f6df28be5a1265cfc6067919a94f9f3a7f6d95b2470d8dab89295f97011fda4cb991d4698ed4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897226, "uuid": "d7698265-f62c-48af-8d55-039567e86050", "value": "8CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897226, "uuid": "402e3e7f-94d1-45bf-bbc2-7fb9c3d5ecad", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897226, "uuid": "c6df779a-315e-4b9d-ba74-1923f8be3d80", "value": "3072:0A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:03J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897226, "uuid": "17404757-4f32-4055-a036-b5b4dd4af695", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897226, "uuid": "2d06624f-44cd-498c-8d78-c6c886c873e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897226, "uuid": "7587e9a1-5725-4578-945f-05c737ab0509", "value": "b214a806_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7eca2f-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621864949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864949, "uuid": "bdf9a6ca-4506-4aba-9b73-abfabb5a9dfd", "comment": "Malware payload (TrickBot)", "value": "1c2102da230d1ebe49df949ede0bf738", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864949, "uuid": "18e790de-27ab-44e1-b96e-45537303991c", "comment": "Malware payload (TrickBot)", "value": "9c5eb6d4b99bdd95fba7618d5db719d2e4c1c107556203a2eef83c236320a1f3", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864949, "uuid": "b8e8f852-c9a5-4f67-8650-7487334e79b0", "comment": "Malware payload (TrickBot)", "value": "74823493ff96539162fc752b76c0f0296f83d36b", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864949, "uuid": "d63ca4a9-cfac-47d8-a7bf-2c3874c2e733", "comment": "Malware payload (TrickBot)", "value": "201bf9081f7278aa400ffcdf64165079f0e8bf06c7941b90386cdf0295c099cb2ba4d8df8dacef9c58aaaa637d06b5a9", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864949, "uuid": "e95639d8-9bee-4676-affa-1200421f227c", "value": "4294E00236E0817AD3BF127E4FB557209BBBB860DFF28A4B2F405E8D5D349555E29322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864949, "uuid": "05514fa2-24a2-41ba-9f86-2407f937befe", "value": "145f081aec8f3ebb691562c6155ee3ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864949, "uuid": "54a709df-769f-43e4-9489-07c6615bfa14", "value": "6144:2KjMh5gPIz0WxXZYVBxtSN9ft8qB1FUJ4YaWKGDxzzQ2x36M3P6nl7Og:2KkmPIpXdzfFUwWKozxKl7Og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864949, "uuid": "ae1f20c0-5e76-4cc0-a4fd-05be4e6add94", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864949, "uuid": "26f91344-3fa0-408e-acc3-ed2c97755084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864949, "uuid": "e6589f07-72df-4051-b87f-54fbfa25dcc2", "value": "1c2102da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c565730-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879389, "uuid": "f8c6e4d0-6b00-4406-8078-f9ec8860d7ad", "comment": "Malware payload (Dridex)", "value": "5bdfaef2d1ce684a233d183ecb4e25f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879389, "uuid": "8a46917e-55cc-4167-b967-7a8ec34593ee", "comment": "Malware payload (Dridex)", "value": "9cb8caf9448cc952512d248bd87bab347aa32ee48e7d5839b58a809330dd19c7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879389, "uuid": "e729d74f-f0e7-487a-a2ad-6bea10fad887", "comment": "Malware payload (Dridex)", "value": "d05a31d03a93f44cae7fd18c2a29bfdf9fc1185c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879389, "uuid": "aa578950-3cd5-40d0-95e5-8666f568d77b", "comment": "Malware payload (Dridex)", "value": "e3f96522ab2eae6f96a31004af4b2889bce0e6e274febf9cc6774b8304e6f352b12d6cdbba35247caeba11ba192d0abd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879389, "uuid": "e82a6e42-a636-4f27-a9e6-d5825bcd4623", "value": "7EF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879389, "uuid": "31e59327-ac65-4719-9dd5-812c6422c76b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879389, "uuid": "776a5a27-2f80-41ef-9025-d30313da8727", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879389, "uuid": "c0173594-9dfc-476b-9ced-126b0b3c3a50", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879389, "uuid": "89ba3218-9534-45a2-8f54-faed0c18ed65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879389, "uuid": "155ee161-dcd0-45ac-99d7-24a12bdb787c", "value": "5bdfaef2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bd5962-bc5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839670, "uuid": "1597c97f-e5b5-40bd-9f7d-2cb66bfee07b", "comment": "Malware payload (Dridex)", "value": "c35b8c8aede44bae5b1b805f860c1bab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839670, "uuid": "39f2e598-c365-4419-8a24-b9d43053e648", "comment": "Malware payload (Dridex)", "value": "9e52cc3e5f09f1d24b38b88f6f01c5775ef716a26b87d1482b6f63e95ea2f73f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839670, "uuid": "593a3dc7-f524-4c27-a71d-dd0d70f2319d", "comment": "Malware payload (Dridex)", "value": "48fc7506f4505d752ce276ab1d43e69aa221f5e0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839670, "uuid": "b4817255-4861-4542-bc24-4ef05981229b", "comment": "Malware payload (Dridex)", "value": "00be3957f424bdd97995d2b53d84f12dbc5b8bdcbed4c57132b914932252f5870b0d352dd332be5d63d14b4c67dfc3d4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839670, "uuid": "33cfe55b-5da2-40ba-bab0-008bed2d7d81", "value": "00F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839670, "uuid": "16409ee0-d491-47c6-a868-02ef03ac642d", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839670, "uuid": "300f5f69-aef3-4273-9032-0ca96d59c41a", "value": "3072:IiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:TeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839670, "uuid": "a3486ca7-8086-46d6-a517-16c14f0f0980", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839670, "uuid": "4f66915d-d92c-4aeb-8612-2ae1d585ac23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839670, "uuid": "0b3c8323-190d-4156-bfe5-091fc24ea464", "value": "c35b8c8a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da116a50-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868460, "uuid": "08280697-a8df-4668-b47f-50375888bbc9", "comment": "Malware payload (Dridex)", "value": "21d6fcf7a009b704143742c61c29035d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868460, "uuid": "ce43d313-8d7e-4bf1-905b-4be9dff38eb0", "comment": "Malware payload (Dridex)", "value": "9e6c6ab70a319806e8c1e4a08c429daf06d3250771e1da84df2669ff800a1612", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868460, "uuid": "5a5e03f6-54b4-4df7-8fa7-085934d1cc12", "comment": "Malware payload (Dridex)", "value": "f940d3ebd7cc13dc26846770d7ffbaebd446481f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868460, "uuid": "dad4ae32-8e54-46ca-8279-8d18785b1ab2", "comment": "Malware payload (Dridex)", "value": "01aa8de2b4cf822dd89314c04b1441dbf66775de5c50c4a2b8714f93f0638c48e0d1a6a3b55c890fef181d564f18df7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868460, "uuid": "732722fa-91b1-40c5-b1ce-aca4d6b5cd53", "value": "CCF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868460, "uuid": "0f7bcc44-5ec2-4be5-9f64-547b9a2f5e14", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868460, "uuid": "5612ef7b-07a6-4e02-b854-481fc17a0765", "value": "3072:Hlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Hlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868460, "uuid": "e741ebd7-935d-4a31-9db9-8726425f8ee5", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868460, "uuid": "6f11f210-97b0-4034-9af2-c86f7e0bd473", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868460, "uuid": "53c8daf3-fe98-4ea2-8be9-f6314771ee34", "value": "21d6fcf7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aadc8d68-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621836168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "92c47431-b872-4337-92fe-f5d1cdf8a122", "comment": "Malware payload (AgentTesla)", "value": "80b0c0d1879e0e9cb5e33877a00bc98c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "a6a0de62-0fb1-4be1-899e-f0816c5f921a", "comment": "Malware payload (AgentTesla)", "value": "9e99b814e113b95bc9807895c7f3351d60f4fd71f2f67614ca93351ffa03a363", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "c41e9099-b198-4c40-bc25-9715ba19a11d", "comment": "Malware payload (AgentTesla)", "value": "2a18159f145ed1de197f89c0f95d466f47d95f8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "1299a6c1-f781-41c8-8aaa-0cfc817e169b", "comment": "Malware payload (AgentTesla)", "value": "ea7595cc6e0ca48087fbcf46d1e969df865bbcad93df48c77cdb8b576e6355f6b16e15edb8a3ac68dc97cfc9a05f3cbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "e151fc8e-f934-456d-9277-75bd7dcb2f80", "value": "09F4E0A523F8DFA4E03C87794434A1204FF16C67D626E606BEDD329A7F76B421653B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "06a4f9e1-20b2-4928-ab8d-1f56c2410be7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "54a61e5f-31b4-4017-89aa-85ffb14b131b", "value": "12288:jzy6C7XwwgIf68W8U4YyX9STDp9LmALSg/WTMw8E1WohaZ9jWRTVCuUacwKKzeaJ:R77ePX+KALSTTMw8ELq28Sze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836168, "uuid": "b674e063-91a5-4a0b-96d3-ec87732c1970", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836168, "uuid": "6d4528d1-8ecb-438e-b05a-110b9d35eecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "a95028fb-61c9-44d7-baa6-f4dd9a5d1815", "value": "SKMBT_C36017022617080.pdf (30K).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9d76d4-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868489, "uuid": "95a2a4bf-d888-4929-9b12-3efdb1eb92b4", "comment": "Malware payload (Dridex)", "value": "0fb0cd02c0709726276b71a4dfed9af1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868489, "uuid": "a2289a18-c5a6-4c69-a1bc-8dd18ef1dac9", "comment": "Malware payload (Dridex)", "value": "9f3584e1bcf7bcc1c1c340438a78c592652320f429a40b8f3e6f9c00e961ad04", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868489, "uuid": "98111cb3-7dfa-455a-942d-e85264273c2d", "comment": "Malware payload (Dridex)", "value": "56c185ce2431f0642325b3f14e5e55b14324936b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868489, "uuid": "2bcaa35f-0210-4b09-ad38-d669a4ecd6e1", "comment": "Malware payload (Dridex)", "value": "d5d10b9391adacc9c3ccdceda1a9b243f8cedb9ac43d2dd821665f6a010c327f921a09be8f94f51457e88c6d6cfa78fe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868489, "uuid": "dbc23295-c09c-4321-803e-13577cd85454", "value": "F3F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868489, "uuid": "4e81d9ac-e2d9-4b0a-aaa1-d8f19240b119", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868489, "uuid": "7b5237d7-6892-44c1-a2ee-aeae39dd7e42", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868489, "uuid": "236eeeef-a3e6-4560-97f9-de004c9d2004", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868489, "uuid": "64fe1d09-9644-4e9c-aaf5-e3961644de0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868489, "uuid": "ff8bc395-c837-4555-8a05-b21eaf5a018d", "value": "0fb0cd02_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f978c20-bc5c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621839102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839102, "uuid": "cd1318b1-8d42-464f-9ab0-0bc395fd2ba0", "comment": "Malware payload (AgentTesla)", "value": "b94960997d1fac054f91e03188fa0f12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839102, "uuid": "dbb1408b-50bc-4608-9eff-d7ab0185a1d4", "comment": "Malware payload (AgentTesla)", "value": "9f7704045124fbd39844bc4a17c34b9d1d8530ef43f48ec91ba9c559f5b454d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839102, "uuid": "4c9a0f63-0fe5-4ba6-ab57-eb1dcf1fe849", "comment": "Malware payload (AgentTesla)", "value": "79ee952f4088adf6d9e62fe735016ca9da71ef05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839102, "uuid": "427d131d-6b49-4f75-99a7-f391a8d6a0b3", "comment": "Malware payload (AgentTesla)", "value": "d22164e8f4a15d01442a38603968fb5cad713df234ab2fd96c13614f670ccab7b9f106656120ce696fa972ac380910bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839102, "uuid": "3f3309ae-d09a-45a1-9c89-4c79f232e066", "value": "3EB4231E5AF6739C4901B703C70EB60D7090739B6A64EF55BBDC046A6B3106F2A32ED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839102, "uuid": "94300c8d-1d1d-4b57-bf31-d51940dc00a2", "value": "12288:JCBiOS4CtcBOAK7Xg0fDC9AIUavZKaSlhi07:JX6uHfmANYkaSlh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839102, "uuid": "2b9137c7-f48a-405a-b784-214e0d57685e", "value": 507409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839102, "uuid": "16e9d005-9be2-467d-98f8-812769120c3f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839102, "uuid": "f4b1b692-0948-44c8-962b-409ac525b3d3", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf1da90-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814427, "uuid": "f4a4a190-34a1-43af-8147-4978945fb365", "comment": "Malware payload (Dridex)", "value": "03bdda41f05ad3f6b5c0fc38b20670cb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814427, "uuid": "5c4e93d1-9144-491e-b912-e352e4428d2c", "comment": "Malware payload (Dridex)", "value": "a0ae85352e3dc5182fd17cc35f72c577f3cae56bfa3de702df6a7d7f29582ebf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814427, "uuid": "37fff356-0870-45b5-a40d-e41eb5def023", "comment": "Malware payload (Dridex)", "value": "12978cf616bb7249e2a21e5674ad9041f0af4ddf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814427, "uuid": "7ad0c1ac-b871-41d1-b0b6-6233123e039d", "comment": "Malware payload (Dridex)", "value": "09b643e64b75665e0ebe8c670a876e041c2fd7e5d34fe353bce70b5d9a0338e4919ee926d9002f0d558e2868625733f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814427, "uuid": "7027c3ce-29a5-4355-9b28-192cf05eb0fa", "value": "C8F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814427, "uuid": "7c5907c2-804e-4bc9-b653-328af50760c7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814427, "uuid": "88c243c8-318b-4df4-95b9-7c4d475d760a", "value": "3072:piFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:aeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814427, "uuid": "74a353c2-a490-4f7b-8628-f0b14f87530b", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814427, "uuid": "1430a2be-df9e-4ec7-aef2-ec294ca8fa56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814427, "uuid": "ef47fdfc-9fed-4478-a033-3c683090ef02", "value": "03bdda41_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6978236a-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (RevCodeRAT)", "timestamp": 1621872136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872136, "uuid": "5951ed8e-f636-46df-bd79-c461dd5bda4a", "comment": "Malware payload (RevCodeRAT)", "value": "13521ca08216f7aaa0541a2ad77aeb2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872136, "uuid": "3235cc81-125a-4a05-8fbf-206f14454924", "comment": "Malware payload (RevCodeRAT)", "value": "a1492c16ac7f3a351538573eb52ef614e19cd137d28672d8117eead8da570660", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872136, "uuid": "a8abde1b-f8e9-46e2-9aeb-f6ad35d0dac0", "comment": "Malware payload (RevCodeRAT)", "value": "3bb4bde4b535a15fc5d9bde3640f7243607efd96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872136, "uuid": "d8a9f80b-7092-48d1-bd9b-d3e70cac428c", "comment": "Malware payload (RevCodeRAT)", "value": "eb945b552652da1f53e0b2a6b698c3d30e025d01e507651d0536ae7653f980ceb50a751536505c07700067ddfd9d440f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RevCodeRAT", "colour": "#8D7BF4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872136, "uuid": "4dbe3ff6-b2da-49f8-b1c7-947c4769b97b", "value": "E965AD1C146AF525D6A8C2794AC5843BE590EF333131BD59E9D33F983739E80B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872136, "uuid": "ee1e9390-1906-498a-887a-adc8486a0742", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872136, "uuid": "4c0f76ba-e182-4168-a6cc-dec933e029cd", "value": "24576:EBCZ/jUkgtefi550VXQ3h/ELuqxDo4It+5tSVwuEi0N3C8+Nhc9mgTyvGcak:EBCZ0eK5GXQ3AuqxvQqtSTK9mgTvcak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872136, "uuid": "d724de5a-97d9-4533-a6e8-a7eba49ed8f4", "value": 1488896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872136, "uuid": "b8d1bceb-bdd8-407a-a7ef-5de6a30e334c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872136, "uuid": "5a824ed2-a5f2-4df6-a226-04651bad5176", "value": "Goods240521.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c827b364-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1621870577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870577, "uuid": "f2e8f45f-0149-43e1-9a9b-c050d2cdd6ae", "comment": "Malware payload (STRRAT)", "value": "5e1cbb6566f677da1d920c9d22f59bd7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870577, "uuid": "18d14fe7-7c02-4222-9c8f-5a7ffecd7865", "comment": "Malware payload (STRRAT)", "value": "a1660698b8655cb721f71693178d2804caba8aa12c3a25446c6f7c665a30f2ff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870577, "uuid": "484a7d87-7d3e-44fb-b606-7105dc77ca5f", "comment": "Malware payload (STRRAT)", "value": "32e31e15fe42e4cb9e2a03698a5c7bc386311eb6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870577, "uuid": "9882ba7a-8276-4ad7-acb4-f37804dcca41", "comment": "Malware payload (STRRAT)", "value": "606b7ad7b93fc222f023dd4df3ed5695040226c0b3ff17a42c0ff083075a277b65dbc01920aa43a61800e76589726a7b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870577, "uuid": "8a86cd61-3943-4618-a0aa-c56faf468bf1", "value": "5CD302FA83499CDDC7C07C5C615D8E338CA6D9A301F4E2C7E914AA660177AADDB78C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870577, "uuid": "d942e5b5-e00b-46dd-adef-a0be1ee8b366", "value": "3072:z3hdaQo7VJH7cEIWrnLNF9CX1UbPU/If7z8gPXP68:LaQo37TIcEX1UbQIH8g/PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870577, "uuid": "00f44fd5-93a5-49d1-82bf-fdb75104abf5", "value": 138549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870577, "uuid": "49bb06ab-fcde-4ac9-8880-cb6464ca6256", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870577, "uuid": "a26969ab-fedb-42fe-b19b-905a2400cef8", "value": "AGB EmektarMakina Ticaret.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c343d456-bc9e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621867563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867563, "uuid": "7e1c3f49-c3d9-4a78-b122-0aee072d9d16", "comment": "Malware payload (AgentTesla)", "value": "99fe1c029432eeb7ad468ed00ab1ad3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867563, "uuid": "83b04bf6-2374-48ba-bb07-dc384bc9171b", "comment": "Malware payload (AgentTesla)", "value": "a171ac26da3ecad1763e3fe4854f239f501f9668c92c77af86265f5c2fd21bb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867563, "uuid": "0d9d1f41-f3ba-4ba3-b12b-3991132f14e4", "comment": "Malware payload (AgentTesla)", "value": "0f354ba5dc2f51f206f87d3d1315e293623ba5c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867563, "uuid": "a1821fd1-e4a8-4811-9d95-6275b1b5f272", "comment": "Malware payload (AgentTesla)", "value": "7b16e384cc80ee05a08dca3a5dd77c07c0366557a4a1e3ad6cbe0ad4fbf13fa4c4e5b0165dc09ddfca8be92bceaa7b58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867563, "uuid": "6d907ee0-cf4b-4aef-959c-c4f6a597973a", "value": "0BC4020172F88716E9BF9BFA5A651040037AB2476122E74D4DCD70EA253BF938A15FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867563, "uuid": "4b2f8542-80b0-4763-a66f-321e15c75b8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867563, "uuid": "8fcb1aea-de3e-4984-a9c2-e639ce36ad21", "value": "12288:zNgAOghhbZEaNtVijJAH9CVpFXzqS7YCbPz87So3dPC:2yhhGaR+J+o3mVWc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867563, "uuid": "b732d713-3ad3-4abd-bc59-92ab1a02ae64", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867563, "uuid": "9e5d0c2e-5c25-4f48-a8dc-0dd68cfd1400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867563, "uuid": "10b23c75-55f7-42ef-a224-daf10ef74714", "value": "Invo and Pack list.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90b552c0-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621838272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838272, "uuid": "f083e8c0-7946-465a-b7ab-f39c1c2c27de", "comment": "Malware payload", "value": "27a6847162c333d39b9885b8e72546cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838272, "uuid": "a961a978-9438-4e7b-996c-0cf9a7c20047", "comment": "Malware payload", "value": "a17bb3e305532ac8e6dd2785ae50cf5f18a3de6a9ea2a4b75ea841b66ba94509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838272, "uuid": "e77f58a4-83d2-426e-9408-6313878c1198", "comment": "Malware payload", "value": "f0521b0119f2dd4cef29c9a130ea8cb79696d1e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838272, "uuid": "4736be40-d8b0-43ad-a4bc-25166e1d1e0d", "comment": "Malware payload", "value": "32fd5908da6181ca6949ce1e35c53b978fdbd1fcd0d7fbbf3be912ae38a8d554a083156b1046f5c6613cdc2978d64794", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838272, "uuid": "17b1e1c7-f56e-43df-8604-e59e624fc42b", "value": "7484BF0067A1C039F5FB26B40A7593A9A53F7DE17B2080DB62D13AEE5A351E1EC3075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838272, "uuid": "187fc43c-226d-4ebc-a5a0-0bfbbf717992", "value": "c1547c738f79c15afc554fcab1eba054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838272, "uuid": "d7262996-09e8-49fa-8d7e-998fec7f3ebe", "value": "6144:vGSdutDd8fUHYtXuKpJGyaXLeRdufmCCONvOnONwQ09/0+VY2FYkpv:vGSdutDdyUsHpJGyabygXNvO5i+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838272, "uuid": "a87e126e-0c16-4753-b835-174e2c0bc82b", "value": 373248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838272, "uuid": "d5af3c90-d4da-40ad-b615-fbf4f8c115d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838272, "uuid": "6a2a9a94-50ee-4787-b13b-8c0a106aaac5", "value": "27a6847162c333d39b9885b8e72546cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c0a8ae-bce3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621897247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897247, "uuid": "1a086cf6-9f99-4264-9309-09dc7d9c969e", "comment": "Malware payload", "value": "9518886f70dd223fa631d5a8c64f42ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897247, "uuid": "704b0606-b800-44e3-b2a7-45716c8fa82b", "comment": "Malware payload", "value": "a1bb52dfc75ebebfa43a30fee4504eb3272f83c84ed76f3fd4f62660a7191424", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897247, "uuid": "f631925e-2d31-48dc-a365-a5692d76e3da", "comment": "Malware payload", "value": "3d05aee1b93e7d8dbb5df4b3dd713e271a2d2456", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621897247, "uuid": "f1330542-a4d4-45cb-9a69-057ceadfd94c", "comment": "Malware payload", "value": "ea5c19f05e86d4de25df7b87b1aebb3bbb1679cda00415f2dd83adfbcea73b1e8b9d71a64ff5dbc1aaa7df81968f416a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897247, "uuid": "e949a7d5-ed67-46f0-a7b5-bf3a8bc63811", "value": "7AF3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897247, "uuid": "8d93f2dc-bb2b-4cc8-904f-78b87fda42e5", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897247, "uuid": "6ce90f0f-dacd-4ffa-ac5f-02e59581cd19", "value": "3072:6IcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:Tc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621897247, "uuid": "729d49d2-e254-4b41-855b-677ee721b92d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621897247, "uuid": "990f31b1-ec78-4840-b37c-51e36e3ae329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621897247, "uuid": "f04f6834-6035-4003-bef2-1a1224d0d376", "value": "9518886f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c29511d-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839875, "uuid": "ce76be15-594c-45ae-bf16-a5efd27cc4b3", "comment": "Malware payload (Dridex)", "value": "b892dd9a9ed4a59397d2009704c44352", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839875, "uuid": "53f95cf7-9078-4105-beba-d70a75fae178", "comment": "Malware payload (Dridex)", "value": "a2ee7f546e3fb8599b87dd288e1ed8b55e140d59e470220b2dc359fc15f28c89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839875, "uuid": "898b7841-4dfd-4605-a97a-43b57169b047", "comment": "Malware payload (Dridex)", "value": "50cf66f12f63503e73df31a9273f17463e01dd15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839875, "uuid": "f4f54fd2-560c-4aef-9f04-6be697ca3544", "comment": "Malware payload (Dridex)", "value": "7c39ff8870a6d75bcff25b76773d995ea762a276f4478338eee4f00ff484ec00e0a89b1e1c07981b13ca008809803cd5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839875, "uuid": "14896c6f-d325-4e61-985c-748511591b02", "value": "05F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839875, "uuid": "21eee7fa-b067-4376-ad80-7b456598e71c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839875, "uuid": "aeccded2-bd2f-4bfc-89b1-b25694c04baf", "value": "3072:YmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:BLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839875, "uuid": "47948eed-3054-4bfc-bbc6-7a1d1778112a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839875, "uuid": "b0d19a2f-e66a-4db5-9582-03e73287ebfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839875, "uuid": "5da7b59a-4896-469b-aec3-e3d74a2f9831", "value": "b892dd9a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b87a42b3-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864968, "uuid": "a60b7114-ed2d-4d11-be6b-f8eec282979e", "comment": "Malware payload (Dridex)", "value": "67af7b657a8b2dd40a36f9e3987c7e15", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864968, "uuid": "27005f2c-077f-4a62-b95e-bba57dbb34f8", "comment": "Malware payload (Dridex)", "value": "a2ef0a8c40b4a27a12c302b3c69a7b014070ad897e11b72f1af9a6d25da27aa5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864968, "uuid": "c3e6a6e1-7048-49fe-9de2-71bcdeb8e5ed", "comment": "Malware payload (Dridex)", "value": "4a698072d45a24b9bfc7bf3a2ef44d6f0570c70d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864968, "uuid": "65e002e3-fcb7-4921-8876-69efc84dd073", "comment": "Malware payload (Dridex)", "value": "7ddab507dddbb0e101d37f72a49bf87d19ec944cf0e89fa9be791823449335270a4b02f2fe587d1fdb9c5f17f582b25f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864968, "uuid": "388fe3df-9348-4efd-a720-b8bbdbbc5f98", "value": "ECF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864968, "uuid": "65ab927a-917c-43b1-a1d0-3697f89b2760", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864968, "uuid": "bf917dad-ded4-45e2-8a0a-4596df7a8533", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864968, "uuid": "a0fa2d70-99b4-424e-8ab6-9af447cd03e8", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864968, "uuid": "5cd8b772-543f-44f6-ba3a-21e97df3e0d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864968, "uuid": "fe4d55d9-e086-42ac-8e83-ea47a6b7af38", "value": "67af7b65_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0df0e0-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1621882883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882883, "uuid": "c2889d6d-c71c-43db-8094-3a3bc9c66edf", "comment": "Malware payload (TrickBot)", "value": "6efd2c2db1345f6e96329a63df101ded", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882883, "uuid": "b7879e41-ffbc-4448-94d4-5f30c2bcf35a", "comment": "Malware payload (TrickBot)", "value": "a398706a815ff97e05f0a5b73b31174f0272d39723710b87c41293a49c94e369", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882883, "uuid": "21d20f6a-f423-4fe0-b75e-20c58f507045", "comment": "Malware payload (TrickBot)", "value": "e891ca1b7556e32d4c96aeea971602faff234a92", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882883, "uuid": "ed122dc9-7a22-461e-91c9-c1f0bca91d0f", "comment": "Malware payload (TrickBot)", "value": "f3546da4663332da3c407abd8c6bc78eafaa3595edfdb944ec0b9924d6ced709a27af86a1211411a5e3d99366a3d609d", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882883, "uuid": "39456e84-1164-4945-aadb-9f46d93ce7a4", "value": "C10402EDAA91E525E7A408F3C4405B831C771FC747876C6A7B12628477B0AF742C4AAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882883, "uuid": "ffe7ddc8-6e92-4566-b4a6-ea44d50492b0", "value": "3072:+Revjbv8cKSsYHIdBasCFifAZxcXL49TAarG10OHzX:mov8cKSsYodBXC0YnW49MarG19TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882883, "uuid": "4acd2321-9aa6-4369-a0ad-c18c3076f3e5", "value": 187789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882883, "uuid": "bde83349-8ce5-41e6-b00e-1109e39120cf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882883, "uuid": "e6c44674-8a90-479f-b6e0-5eeaa7c3d7d2", "value": "6efd2c2d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74835a27-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621871296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871296, "uuid": "fb977dca-75f5-46ad-bc24-01e289227ab7", "comment": "Malware payload (SnakeKeylogger)", "value": "871d6fecff728489a3cce0efdc3d86fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871296, "uuid": "941486ab-1269-4e5e-9bef-d804d546d862", "comment": "Malware payload (SnakeKeylogger)", "value": "a3d8fe6c96c7cdd697e0f0b2b151891e0082aef6c1d41b01fa7ce50e3d6d640c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871296, "uuid": "e2681ea6-beea-4f7d-be3a-53c887645dd0", "comment": "Malware payload (SnakeKeylogger)", "value": "6d23bf91f5c286d8f4928a0083e6c37b7f36b50a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871296, "uuid": "82b65d17-fa8c-412a-bcf0-83de78d147c6", "comment": "Malware payload (SnakeKeylogger)", "value": "107b07095e07ab452b2f99a9c5b0da22eb19e1efc60740e670018a56caabc1be920008a991e6d6fabe66b02262e247bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871296, "uuid": "3ce8daab-3e76-4948-b5f6-8ab549a13b1d", "value": "CE257A2C652AF026D5A8C2794AD5943BE891EF3730307C66E8D33F497735E40B98227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871296, "uuid": "c46a42ab-fe38-46b3-87ba-5f6a72cfa906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871296, "uuid": "5ef4c585-82c6-4cee-a6dd-30b183942704", "value": "24576:IDf8rRw0OQZapfAhK3fuzFVi9xom7UTOF7PN:YBPFx13fuzq2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871296, "uuid": "0911cf2c-a6cd-40c3-9183-85475820d851", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871296, "uuid": "7e78853a-92b6-4591-87fd-63e91be42016", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871296, "uuid": "45a6e999-ac7a-49e3-8a73-d61ad4b85d85", "value": "Copia pendiente - PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479b84ed-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861342, "uuid": "4e64c5a0-a07f-4c06-96a3-71037f185b35", "comment": "Malware payload (Dridex)", "value": "7adcdd5b13ad40970c1cb0d65dd0ee81", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861342, "uuid": "9ba90dd1-2529-4cad-a203-be4515fce62d", "comment": "Malware payload (Dridex)", "value": "a456e2f6bf05ba0a7d4fab442bfac2262e2b736b277f8bc2aa992e98de7cbf1e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861342, "uuid": "1e713319-4c15-4d22-8902-62e41586b9cb", "comment": "Malware payload (Dridex)", "value": "d21110372065522036a600bd997fdc12e78d39de", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861342, "uuid": "7e4c2510-e8bb-410b-8310-f0cc8f4e1c97", "comment": "Malware payload (Dridex)", "value": "3a84f30f3b2a37749c7ae91576b7a1f4ae8236bd74bec708d8fb9078b7ee882d6cda23ebdcdc1d853b85dec8341f70cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861342, "uuid": "15f4eb1b-f4f3-43ed-98b0-eb2dd2718b5f", "value": "3DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861342, "uuid": "512ab30c-4fb0-4dc9-b48a-dd2d1717db31", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861342, "uuid": "877bbb18-b922-432d-92d3-564e0eefe672", "value": "3072:OmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861342, "uuid": "e00c6ef1-7977-43d8-859d-948d673203f3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861342, "uuid": "5a4e3647-35fe-4745-837a-ebb843a1e711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861342, "uuid": "225557da-3556-4e41-bce4-23cb8f71e4ad", "value": "7adcdd5b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc7336e-bc5e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839821, "uuid": "306fca13-f8d6-4e86-bde3-56d9f5359378", "comment": "Malware payload (Dridex)", "value": "01ca4ef54dffcfa2c9936a8079d85d1b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839821, "uuid": "c298f0d2-fba4-476b-ab58-96a889cb2f80", "comment": "Malware payload (Dridex)", "value": "a50a588d84516080c5c7ebc00eff07e38f11deefd7af2a682c78d306d77d52ba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839821, "uuid": "e46b65a2-6908-4f92-bca8-f9af777b7ddc", "comment": "Malware payload (Dridex)", "value": "93b07b22d570694f3802f8a566152904e75db82e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839821, "uuid": "0370774f-baa4-4b99-ad27-59916b9f2a96", "comment": "Malware payload (Dridex)", "value": "352c22829e7621756c347571bb762fbee1b2255930b13764fdaa48b34ca8e4e71d6c728bd2455c68179c43da39fbcd50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839821, "uuid": "ecc3c604-7d06-437d-bfcf-8f8cbee28fe2", "value": "E8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839821, "uuid": "730d27b7-4ba9-41b8-8bfe-1982c803e6bd", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839821, "uuid": "fa3eac34-894a-4a48-a1ed-964b86e61e42", "value": "3072:ZmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ILc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839821, "uuid": "7e0efd45-1af6-47db-a0b8-9c51563204e0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839821, "uuid": "f440dfc6-d201-4253-b656-6697517ba595", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839821, "uuid": "c773dc31-e681-4d3c-9491-6303d74b86cb", "value": "01ca4ef5_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3330a46e-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814493, "uuid": "1f1f5405-ff5f-4087-bd92-8e49e6928d87", "comment": "Malware payload (Dridex)", "value": "21cce870f7162409a37e69229e5c3584", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814493, "uuid": "591ada6f-0bf6-46bd-b644-d6496ce194de", "comment": "Malware payload (Dridex)", "value": "a512cf3714785ec0ece0c43a7a295d7bb2d0ddac5c020c5d461d6777768746ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814493, "uuid": "f581b1f9-d152-4726-acd0-52d1cbc9619b", "comment": "Malware payload (Dridex)", "value": "98b84ac6766eb0b4df08e55ab238bf9881ee9ac9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814493, "uuid": "dab0a1ea-2b28-4eeb-9b21-97a609c0bace", "comment": "Malware payload (Dridex)", "value": "0769cefaee6407292b42a909fd5d49913369edb8495446beebf49c0518ce484ec8484136577e96ac19f4e31f43734237", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814493, "uuid": "a0dc77fd-6741-4a18-8ad1-1911577f8d68", "value": "7FF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814493, "uuid": "89c77056-a6b6-4644-9b8d-141e2c81203a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814493, "uuid": "b3697c10-61a5-474e-8b17-0430e62db8b3", "value": "3072:/mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:eLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814493, "uuid": "6ec3a787-a7b3-4fd4-bd13-15519cafcc8d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814493, "uuid": "61282fa0-9bc1-4fed-ac94-0f487fbb45a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814493, "uuid": "eb5018e3-c65d-4b3b-bff3-594f4b317653", "value": "21cce870_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddb70a3-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825302, "uuid": "7440a306-4808-44c8-8d54-14d292eca587", "comment": "Malware payload (Dridex)", "value": "2b43115f436b3f45d8bcfa5b10a7e484", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825302, "uuid": "670b1e3a-1e5f-44ee-9ac0-cef197223d36", "comment": "Malware payload (Dridex)", "value": "a53de49bae3c32af49925d1228ad818c7409396f26ee8cd11d31394e7177bf72", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825302, "uuid": "98071487-9641-49bd-b88c-07bda5c7cb70", "comment": "Malware payload (Dridex)", "value": "81e6a835c5172270d478649e62cd67888c2ffc15", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825302, "uuid": "a69846a7-ba5c-4970-a091-67083f2499e1", "comment": "Malware payload (Dridex)", "value": "9a0a953645f5f2701531a6f3bff8096a23c5d086a4363f768323340430a027b308c7eaeb2303ba9336c7747f7e4a2eee", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825302, "uuid": "93402525-ca47-42f1-bff4-8d378158ff47", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825302, "uuid": "e087074c-2dfd-4636-8fd9-4ee88fd5f84a", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825302, "uuid": "3fc13bc3-f722-4a27-88ba-cc6e46dffa63", "value": "3072:9mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:8Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825302, "uuid": "402b8775-4cfa-40b3-be3a-dff9041a53e3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825302, "uuid": "e1b04b17-0575-467c-a883-9091a612e5e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825302, "uuid": "1b81f0a2-6f0e-4f6a-81af-e78e39fd25b8", "value": "2b43115f_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f0fe72-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821698, "uuid": "6e15dfee-edec-4837-a296-3fa5da91ab14", "comment": "Malware payload (Dridex)", "value": "0711c4461e849ec9b89e0732e62df2d7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821698, "uuid": "eb1d4bc6-1b01-4aa5-b548-7eab8edcbdab", "comment": "Malware payload (Dridex)", "value": "a5756b4b033061e1495f6aa99bf17e169ca1f544326f19f297f39bcb7707f37a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821698, "uuid": "92c2e5eb-02d2-499d-95c4-2c6f37ddea5c", "comment": "Malware payload (Dridex)", "value": "79b83ea40734d7e20590f5145f9074568f80d750", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821698, "uuid": "a29d294f-d878-4b75-a566-fdf79c8d090f", "comment": "Malware payload (Dridex)", "value": "0314c519e29f7c14ef1d8f4ad4538b64638416114658c547026bddc53c3b243b101b783d67f431586989746623e12d64", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821698, "uuid": "d2dca737-32d5-433c-8217-c96a144974a5", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821698, "uuid": "2a1adbe4-1868-4a30-b376-e54ac442856e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821698, "uuid": "d34e225d-10be-4005-befc-abe21752e42a", "value": "3072:wmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ZLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821698, "uuid": "da40aa35-ef50-4cc5-97c2-87f7cea195bf", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821698, "uuid": "ee723cdc-2725-46b0-b6ef-d7462d54c133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821698, "uuid": "541ce813-2253-4574-9a69-c9f1f74f0698", "value": "0711c446_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6d08c7-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1621871227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871227, "uuid": "1403d405-c73f-45b3-8956-c2e4e23e7854", "comment": "Malware payload (AveMariaRAT)", "value": "9df3b36279313b95e818c90ba404e446", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871227, "uuid": "5f103886-d075-4cfa-bfe2-545b6a8d2b44", "comment": "Malware payload (AveMariaRAT)", "value": "a58cf7753cdff434e81e0163ec97f8e1a8b32c80ddfa7cbf021778a759f78842", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871227, "uuid": "70d7d875-6c6a-4657-bb87-0cdcf315d917", "comment": "Malware payload (AveMariaRAT)", "value": "b9fad9b9d00ac30a9c950110207971fff88a3f87", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871227, "uuid": "b2c2ba0f-fe0f-4c29-a8cf-6f3ce0de3508", "comment": "Malware payload (AveMariaRAT)", "value": "13640af737f9383ba1f8c3e39f6be1aa0be3252154b87a534d259fb045cc16f1f7a44114ea34f3c826686811dfd8ba68", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871227, "uuid": "07aa453b-d163-4fc8-953c-f9a4740c7944", "value": "7F640070B1FDC2D4D1A97978EE5BB0F44540EEA0D9218C2F3CA87E0A7570AA5F87162D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871227, "uuid": "18ae089d-0d23-4204-a650-9ab6aa7c6cc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871227, "uuid": "8f3d760e-f93f-4339-8f5f-64192f27993b", "value": "384:eRBuckoZ4Stv+X+1Z6dFTCI0/LTuRsRXfc+99aRh2iPzDTkurgebfaS+8HCHuiyM:x7k+KZ6fTChRvc+9YP2ifVfaS+jbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871227, "uuid": "5c031b3e-c518-47e1-8cd8-6f21ac5e5c0c", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871227, "uuid": "d094b197-837e-486c-aa95-5b9fe988f3d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871227, "uuid": "1008bc1c-eb3a-4eff-a593-46a41c79fd84", "value": "Remit receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e019ba7-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621864870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864870, "uuid": "75c9dc4c-54ca-47ff-91cd-4b9871ae54cb", "comment": "Malware payload (AgentTesla)", "value": "92c9427379011484f0bed658293d97da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864870, "uuid": "b0e01eb1-515c-4059-95f7-14078d4c2f5f", "comment": "Malware payload (AgentTesla)", "value": "a5e11eb6f9b6ab4d4c7ec17df5d6c3fade97fe6516853fe290e563fa9313ce86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864870, "uuid": "a7c9a1f3-115f-4e15-a083-a7852274527e", "comment": "Malware payload (AgentTesla)", "value": "8da15fedbb57ac27701dbd379ff80ddf9696ff86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864870, "uuid": "4bf607f0-8e84-4c11-8ab3-c32d5105ff4d", "comment": "Malware payload (AgentTesla)", "value": "cec1aa5e8c06c480248deb1e47a385697b73787abdb980352871683304f955e13cfea9557c8d4afde8a7d500d215ad21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864870, "uuid": "33ddbf1c-07c8-43c6-8cda-269c098c3deb", "value": "78749C59F3749CA2F81782BE887AE9352137BE595527040E374A362D49B33C350A7F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864870, "uuid": "47db21ec-ed08-4f11-83ad-534bb19a3aa9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864870, "uuid": "2c1d8130-424c-495b-a5cc-7b48739c5c28", "value": "6144:MsL33udxxYe+n8dbwF4zG6yZVwXNOn+rTRI03Bkz9o:H33EcFQwf7DwdlRJRkRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864870, "uuid": "bc41daab-894a-4762-8fdc-06a75f53266d", "value": 345937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864870, "uuid": "9d6d4ad0-7dba-4e6e-a9db-489f1faa6889", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864870, "uuid": "eea7ec7d-39e2-4754-8968-c1cfbef6e95d", "value": "92c94273_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0683b83d-bc78-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850925, "uuid": "6c4bda6d-21e3-416a-a3f9-3ca18992eff0", "comment": "Malware payload (AgentTesla)", "value": "14e1e6587651c710a6f84f49b8f704b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850925, "uuid": "aa053ff4-ade4-4a99-b9a9-f2a3da75f239", "comment": "Malware payload (AgentTesla)", "value": "a63b5d7c0b7d1e06db1c1ed33ccdb7b0910b297a50979e1bcc35326446161a2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850925, "uuid": "d540b4b7-b127-4a34-b6c7-d3e818b46950", "comment": "Malware payload (AgentTesla)", "value": "62f83807a2b0ad6eb0f42fb2a81849e0c3fe68ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850925, "uuid": "186d2124-f64a-4112-9b83-b7755ec7a775", "comment": "Malware payload (AgentTesla)", "value": "aeba63537707a35afddee2ebb31827c9846c660e3476cf475f2ffaa52f2c2baf42f5c5adfc3bdae824cbb284471b5d93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850925, "uuid": "75f37cfd-35e7-41e4-85dd-f9d3b116ce0c", "value": "6505F137624A5FA1E03F5B79902030442BF1E946E760E71C7D6060EC2ED2E95AFE5B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850925, "uuid": "12e811a7-5f8b-49a5-afb8-eec3c9d5288d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850925, "uuid": "d69cdf3a-0f10-44d3-8587-2013aa4a2a84", "value": "12288:syKzi++++++++f++++++++uq/+8w1mC225HQYuMgvMJQbN1MXRgEHmA5+:srzRswMiH3ZJC1MX3mk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850925, "uuid": "5931d1cb-d179-4ae0-9b6d-ffe50e819eef", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850925, "uuid": "22c76533-a2f7-4395-9c1d-bdf91aaadf49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850925, "uuid": "3248f4c3-00b3-4a52-a155-6b0f555227fa", "value": "Invitation for potential projects Specification.PDF!.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730d72c6-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871294, "uuid": "c31c39a5-a8c2-410f-b52f-bc4313947dff", "comment": "Malware payload (AgentTesla)", "value": "f9905c4a2187d2d9d83665c29f8bc14d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871294, "uuid": "567beda4-7aff-4de4-8af1-81e4fa854bf3", "comment": "Malware payload (AgentTesla)", "value": "a644d61c1443b8355b00be70da09b63f791bd9ddfad2410648a32ff0cfe2eeab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871294, "uuid": "f891362e-2813-42ca-aac3-d2439448d126", "comment": "Malware payload (AgentTesla)", "value": "3228f8b180076a173c61f7695b05afdffb5e09be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871294, "uuid": "9be09174-c161-4015-9f81-7a4c4e283587", "comment": "Malware payload (AgentTesla)", "value": "f1d0ad2a6207b5cc288536628dc4baf49f60b9524d01e4c203cfc30b7b872df119013b552fecab735854a27bf9740a87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871294, "uuid": "a3fab93e-9f62-4a48-87a6-659c4e07eefc", "value": "73357B2C256AF126D5A8C2794AD5943BE891EF3730307C6AE8D33F497735E41B88217E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871294, "uuid": "2c70c153-0c06-4e2d-94bd-571c4f62b15f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871294, "uuid": "bf195e1c-3850-4708-8bde-57985f87984f", "value": "12288:yJqy+whisL7zB7KCO6daANyn5VvbSMQXdfguqEljTKB3+z34sq0Z/yM2:yDL7N7rOSFynwgqKU74x0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871294, "uuid": "6487cbad-cccc-4699-ac85-7f28fbda75a8", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871294, "uuid": "8d4cf306-b356-4bb1-8bbe-982440521e4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871294, "uuid": "eb1f6f18-b2f5-4691-8d95-4b402f703ac9", "value": "Total Tunisia RFQ...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad529726-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818134, "uuid": "7e58fa91-9980-4786-aaf1-b5bfd430257b", "comment": "Malware payload (Dridex)", "value": "11827398a3c6291cc43151f0533aa70f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818134, "uuid": "76f0bf84-21d9-4365-b14b-89cd7d17a061", "comment": "Malware payload (Dridex)", "value": "a65fb45137d40219186e5ec6aec8f596bd8907fee8e3b749cb82f5ef7626fbc8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818134, "uuid": "e7dcb983-aa75-4944-a2c1-3d6889e2bab2", "comment": "Malware payload (Dridex)", "value": "620ab0d2f205a8498942434f8d41d04f091f7556", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818134, "uuid": "aaad870b-f392-4c88-8823-2eb031e031ea", "comment": "Malware payload (Dridex)", "value": "e824dc401ceddc338dba6f52b89d2ad59cb6b3e1a26047d74e05031fdd670ceb7181091a12b3b88588b68cd6006e88d7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818134, "uuid": "58765267-eb2b-44cb-8300-cf8061053bd6", "value": "F8F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818134, "uuid": "63fb10b0-ecb0-4a4d-9618-e28696e8228b", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818134, "uuid": "7938dfba-a884-4dc9-af24-91e0dce01b89", "value": "3072:zA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:z3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818134, "uuid": "1369945b-0234-4fff-b318-3241916d79dd", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818134, "uuid": "0b38df6f-fefc-4346-908a-e1692952c82c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818134, "uuid": "6b93421f-23af-46d4-bf5d-df9e5224a7fe", "value": "11827398_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5327d7-bc8e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621860441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860441, "uuid": "97ff00e7-292b-4a2a-98a5-f71f2df0e86b", "comment": "Malware payload", "value": "362b63a8aeb6e2b57cf5ff9fefec3d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860441, "uuid": "989fd4dc-222b-4f19-a9b2-2b6ebe86177d", "comment": "Malware payload", "value": "a67249a9ac60495fb7be68638ba5ff3062ed436a414aaf1beb671c6a47b4ba47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860441, "uuid": "0ab5b354-c48f-45c5-bf11-c9a579ca2411", "comment": "Malware payload", "value": "d428ee1d966959c1c5e53aa0227a250fc8a7e655", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860441, "uuid": "20fda1c9-fcd2-4e71-b451-e3ac7c0e90b5", "comment": "Malware payload", "value": "e07887fd919be2ffcd584aefb65ca9120d1b3cf5ee38c0c6d37493ddbc5b04ad87f60c61caf805443269f4aa4745a4bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860441, "uuid": "fa0af8e1-5b3b-4840-9324-4e1630e7b34d", "value": "EEA4011D3A94B1DFC46BC9729E646D44A624B43A4707E353A05726BCAD0E3ABCF109F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860441, "uuid": "bc2ef127-cf79-43a3-b319-421dab60ec43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860441, "uuid": "3476b883-bc41-4078-ad95-d2524ed6a693", "value": "12288:+sBPRdN7j+cHIGb/g5LY9gy/InXizpqYxog:+sBJLHIRRUQXiWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860441, "uuid": "e71bc5a2-ce0e-41b6-b711-55159f3e5c1f", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860441, "uuid": "7a360de1-cc5d-44ea-90a3-ba720e1d6f62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860441, "uuid": "ceeddf7a-fb25-4e64-8158-a95d8be44899", "value": "SALES ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7644d3d6-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818041, "uuid": "19e84287-ad93-46d0-abf0-9b27cdf59e2e", "comment": "Malware payload (Dridex)", "value": "8b003597c13015d0f16dcb6766c7d921", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818041, "uuid": "590b9c0f-b496-452f-bd62-f24152955281", "comment": "Malware payload (Dridex)", "value": "a6c61632c51e11180f7ccca3c2589046025f8c5ea19cb2433ae608185510c34a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818041, "uuid": "34ac2756-c4db-4f56-bd45-febb753342a5", "comment": "Malware payload (Dridex)", "value": "7b0420699314d5854d8725fe94d00be426b59124", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818041, "uuid": "a48a58af-d2fd-47bc-a6dd-f2abc148b84e", "comment": "Malware payload (Dridex)", "value": "bbb1d4be529e3ab187eb4fec4d333107b5cbc90bd3650e2c280d3e6a6ea6981ac4513394d49a06d31f8bbc80c35ff743", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818041, "uuid": "1d4c02b4-e541-4eba-aa30-cd8a6d6da08f", "value": "98F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818041, "uuid": "54487f85-d694-4ca8-80a0-d955b74ff3d2", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818041, "uuid": "e159daef-8bbc-4e6b-9375-fdb246f28b33", "value": "3072:3lpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:3lo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818041, "uuid": "4182dd32-64c4-4fbe-a0ce-bfc2694008c4", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818041, "uuid": "751b611b-ca3a-4fe9-9f21-ff01ba9b3bd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818041, "uuid": "5362e86b-4e33-4413-b0cb-829235fad2bb", "value": "8b003597_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38260341-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872054, "uuid": "725b74ee-ee95-4ead-bff0-35672c0eea32", "comment": "Malware payload (Dridex)", "value": "b1ff73df6387339714335769b29c3c00", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872054, "uuid": "2d6f2914-3099-485c-b3f9-8106a8e81856", "comment": "Malware payload (Dridex)", "value": "a70dad1f3174e5fff212ea008e262c360e920380c1fb1730f5eaec08191a7021", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872054, "uuid": "fbd86722-64e5-45c4-bcfe-c103c61b3fb5", "comment": "Malware payload (Dridex)", "value": "87838e7e2f941bd92dab80b62a06b830a04bb1b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872054, "uuid": "8b6ab525-9c3f-4af6-9336-a878d474c335", "comment": "Malware payload (Dridex)", "value": "7c346e0d1eb4268f96c7e5557a8660cf8865e297d2b0312e40933604ca8f9857cac88861876969b6a810adb490ca9ef4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872054, "uuid": "5909e880-ecbd-4a7b-bac3-c97b5bef0a8a", "value": "D5F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872054, "uuid": "7f27d5a7-b509-4e4f-b9a7-6714f384e6f2", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872054, "uuid": "51839834-f6ed-485d-a0d8-45b77b6e9956", "value": "3072:AmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:JLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872054, "uuid": "cd05bb6b-19c4-4302-9268-532bb8cf358d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872054, "uuid": "c23a8283-a089-4c73-a1e9-34de0ff7aba6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872054, "uuid": "8fce31f1-d645-4697-8526-ff9dadbda636", "value": "b1ff73df_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9a1684-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872301, "uuid": "bd860f8e-d930-49bc-8f18-a0a6fb426724", "comment": "Malware payload (Dridex)", "value": "9421e8159c4a3633727cd7299cf98f82", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872301, "uuid": "3f4759b3-3981-4de1-8080-4063e5545267", "comment": "Malware payload (Dridex)", "value": "a73a7dd8a555e52c2b033140924dadec93f39744f7dc17de08fa0fcc8e8144a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872301, "uuid": "024f5bba-0de2-4be6-9672-0d905a862be6", "comment": "Malware payload (Dridex)", "value": "343f77fdc54b4ab0f7f3d11974b6c5419324c827", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872301, "uuid": "bc6449fc-c305-454c-af30-78b69e848335", "comment": "Malware payload (Dridex)", "value": "3d3116df8aa9ec989e71d4a35ed6c4907137bb1e88f5920bbab77132a2183b8891e0cdccf66985d326e19a55f49da402", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872301, "uuid": "29ece6d9-f705-4adf-a86f-2d2ab33a7e37", "value": "72F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872301, "uuid": "8da09395-e66f-4b29-83cb-c948eac5c392", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872301, "uuid": "8dc4441a-b6dd-450a-af0a-3da8b581dd09", "value": "3072:EiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:HeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872301, "uuid": "e1cf6d11-a02e-480f-933d-1df7f72fef05", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872301, "uuid": "207c390a-fbdb-46fe-a566-5b7f34c3370d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872301, "uuid": "04fae916-b74c-4f5c-8670-1e7afbea605f", "value": "9421e815_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dee4e64-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879419, "uuid": "1d1652e2-ec16-4021-9ac0-4fdd5705182c", "comment": "Malware payload (Dridex)", "value": "6c07639276be1a4557f4875a4df160b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879419, "uuid": "2c5ae6b4-9a92-43a5-8521-f39115bb71bf", "comment": "Malware payload (Dridex)", "value": "a79896f901932ee53aa80519902bb2d3a0180b0aae29a9dcdb0debe6bdf2bc10", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879419, "uuid": "c9713dc7-2139-408b-9fa4-6c3737a1274a", "comment": "Malware payload (Dridex)", "value": "549e6adcf41407b1bcf09625a666531630aee3c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879419, "uuid": "cf11f22b-c539-49fd-9843-38540c01d85c", "comment": "Malware payload (Dridex)", "value": "20465727161b12e0f75c94a417cb5361f2e69e46e34899fb8ce63a7bcbd1126b0b131b649ce616d7f1dbf8421e1d5a0d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879419, "uuid": "f4900970-0a5a-42a5-8471-6e7045df60ee", "value": "4EF3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879419, "uuid": "cf3c0f57-6cf6-44ea-a55f-dde3916de1cf", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879419, "uuid": "73ea1451-06ce-47aa-bc66-22a8fc5e2a8e", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879419, "uuid": "46b2beb2-b57b-401f-9e75-ea59036fda49", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879419, "uuid": "acc2399c-0c4d-4516-bdcd-068bb8ddee32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879419, "uuid": "0ed3bfc5-bfd5-4096-9f10-10f6b7101657", "value": "6c076392_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecae4a5-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836148, "uuid": "fc82774e-f5f2-4c9f-bf37-23eb3c8cb6a1", "comment": "Malware payload (Dridex)", "value": "051a23a3b31ffc1258af63edbb84b26a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836148, "uuid": "0a2b574a-c0db-455a-8013-eeccda25f4ec", "comment": "Malware payload (Dridex)", "value": "a7e98e9659e318113a9995162102524c17635549266d3cccdabb093009a371b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836148, "uuid": "234d240d-6cbe-4eea-bcee-35ea68e8c373", "comment": "Malware payload (Dridex)", "value": "56ea6ff2ea6353a4ed8b3943aeda89c3b6836ef4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836148, "uuid": "ef4e8c42-0102-4085-ad8f-1ef29335aa98", "comment": "Malware payload (Dridex)", "value": "7155e2e7e0f264ce6d963b416e9f260ec0b1775303860a3f4248d3fa18f2d5c677aed90c2fd870a3ff8e85d3ce109447", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836148, "uuid": "c647de3e-b0fe-427a-abc3-520b2bafd183", "value": "3B04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836148, "uuid": "1200b94b-42f5-436b-8d49-8145fb489a87", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836148, "uuid": "43ddb2ac-d8e0-4f8d-b0c5-6ddda3fe385a", "value": "3072:sV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:sV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836148, "uuid": "1c12b152-b173-4066-bbfc-53139fd71e25", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836148, "uuid": "2ef4189d-7c88-49d4-bdea-c95fa7461087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836148, "uuid": "8211c971-6911-4cff-96ba-72a78bb4679e", "value": "051a23a3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e621d967-bc58-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1621837556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837556, "uuid": "499847dd-5d14-4789-91f8-835ead318b24", "comment": "Malware payload (CryptBot)", "value": "09b460f7e2d59d2261bec59fbfd34e91", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837556, "uuid": "fccf1962-1af7-42ca-b065-3325ed0a1893", "comment": "Malware payload (CryptBot)", "value": "a81a2353eb8c94e697947184c8928e1a6da453b7e37c953756c92ce59883b099", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837556, "uuid": "e714ec82-212c-4501-be2c-6f3a980f859f", "comment": "Malware payload (CryptBot)", "value": "823989f3759081be84c5fe2fb9079033c1ba1b28", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837556, "uuid": "70cbc8c0-2e5d-4efb-9ccf-86fab929425b", "comment": "Malware payload (CryptBot)", "value": "75dd7513d1459da2cb7e8a46666f4bb5f081d961dfdfb7a930dfe03eaa4464aff2b50abad945bf547b0c8a7d34e792cc", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837556, "uuid": "21bc893f-317c-412e-8f07-5e434888ebec", "value": "82F4F120A6A0C435F4BB06FC45B5C2B8A6397DB26B3050EF62C536EA4D745E09D31BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837556, "uuid": "e25ed23b-016b-4a91-b97d-d207ad1bfc56", "value": "a1546b2dd90d8ce5446c70bec3b077b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837556, "uuid": "b6a71bbd-a7f1-4c0e-9a0f-aad4a383293b", "value": "12288:6zl1qUE8r3fOWPrSKsyg8wHF1Mdr4paQlYWVIJPhjkOql30wXfuSXFBEpbe5sKJi:kqOflJg8wHfMdrWaOW7QBljf3XFBEp4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837556, "uuid": "29a430a6-6174-4e92-97ae-23550f3dac69", "value": 771584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837556, "uuid": "dbd06958-016c-4900-bd91-15b3d87bc665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837556, "uuid": "d4d29883-7ded-424f-b475-f92bd32e256d", "value": "09b460f7e2d59d2261bec59fbfd34e91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad513cd-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843336, "uuid": "71d8d8a3-9b85-4699-bbe8-e3641469b5c4", "comment": "Malware payload (Dridex)", "value": "fc5993dacf320a1afba59214af55bf8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843336, "uuid": "233155c8-2a1b-4486-a9d0-3cbb69b67669", "comment": "Malware payload (Dridex)", "value": "a89308d2af8a3fdcbe11532ec5df5b8d7d83b4895156b3d7fe218162dcec99b2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843336, "uuid": "b4306535-ffe5-4854-aab8-99065801ded0", "comment": "Malware payload (Dridex)", "value": "c09da5fe125cc51bf27d82489146448e5af97383", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843336, "uuid": "cd8469bc-e0d2-4fb6-ad73-a87476ae9cd5", "comment": "Malware payload (Dridex)", "value": "aaa871f69490e7a29ca805be3852df7f2de886f9787421d4147cbb28c0bcbc1f409e58c237dc9d10fd1729305e382af1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843336, "uuid": "50dd55f2-0c1f-4f18-934c-4d32ceca6074", "value": "1EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843336, "uuid": "c7a1bfcc-06a5-49d9-a027-154068f6cf62", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843336, "uuid": "db632b87-6772-4cb6-afd7-e955fa375a1d", "value": "3072:MmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:VLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843336, "uuid": "6efcc69c-dc88-488b-b038-946a6322f3ee", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843336, "uuid": "279b4ffe-8976-40b1-b667-d4f89dd98b91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843336, "uuid": "9a9a9d68-72b5-4caf-8f01-747ba3eacb4b", "value": "fc5993da_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8d8ce0-bc64-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1621842672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842672, "uuid": "c62d67ac-4444-4521-84a1-809d7ba20a0b", "comment": "Malware payload (AZORult)", "value": "785bdfeb1dccd477a54e637425b40cbf", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842672, "uuid": "6a5861ba-27c5-4890-aee5-62d778837d35", "comment": "Malware payload (AZORult)", "value": "a8b6f3dbc9f856367677e1c38a952e746b6a4ed15e43bddcf9f42640bd0a431b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842672, "uuid": "9c68f186-37c4-4aad-8638-ef9530157103", "comment": "Malware payload (AZORult)", "value": "4d8e954a4b693c99ed50f658d9db3187ae292f2c", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842672, "uuid": "0f200037-3020-4ebd-9c32-9bcae6959206", "comment": "Malware payload (AZORult)", "value": "f683084307e1158fcd980ae76e32fc60cb8dc9c9a5631770f535cee2c5d9ed4db09739333648e42cd5587b0a60924a4d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842672, "uuid": "3dbc1ae7-cd28-4265-a81c-5adcfe876188", "value": "AC94CF583690B59EC877DD328EB42C20EA31B56B932BD30B9057156C9D4E6EACE107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842672, "uuid": "8fc6d479-f4e5-45e4-86d1-1c88582e9e08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842672, "uuid": "52d28a57-3f65-4763-8bfd-206d77d9ddf4", "value": "12288:es+HVX8ayvFObxFl/XMtWRBRWpZJNKW+wQ:DyZ2Ox/xjcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621842672, "uuid": "0ed45b40-44c9-4841-852e-fad01525fe9d", "value": 429568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621842672, "uuid": "92074bf3-8a32-4ded-88a6-d9f031bf5911", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842672, "uuid": "ad38ce33-807a-4a0d-9672-e4d7b044bbe5", "value": "VENDORS FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b41229-bc96-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621864151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864151, "uuid": "732fc92d-fb6f-44bd-a221-818f2a6f252e", "comment": "Malware payload (AgentTesla)", "value": "ad98863de7dd9c31b901d026139f9ecd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864151, "uuid": "d26e1e4d-354b-4a21-a4b6-3b8f28061d39", "comment": "Malware payload (AgentTesla)", "value": "a95487fcc6e10653c359e496d789b3a99abe5c7da8b5d2d426cbb86f4bdc8a75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864151, "uuid": "d5d1f9e6-0717-4cb3-885a-bbd29d786883", "comment": "Malware payload (AgentTesla)", "value": "a8e05c0cbac95bcac8eee51bf6156088f832173c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864151, "uuid": "18cf5f47-754f-461e-a946-e83d99ac2f4b", "comment": "Malware payload (AgentTesla)", "value": "884f64c21e09febab3c715c300504c2fc57a7420d7254efc357482bd39d3f2033fc8f3ec753173e54cb152e9b04dd733", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864151, "uuid": "a5e7b5e5-d159-4d41-8895-636394f64150", "value": "FAD4ADAC329075DFC42BCD728E681C64AA21746B531BD207905B15ACAE1EBDBCF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864151, "uuid": "eecf30b6-9069-4132-a9ef-8462ca9f00e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864151, "uuid": "ef341744-cf1e-4cc6-9fac-6eff337581c9", "value": "12288:FZV3ta0GrHG0z6SurUBp2+1fHpEaBpz2PWygLwtB4LYA5YxYEcq3H4YzY34ECaHS:13ta0GbG025LCmvPHvOLYAWpT3H4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864151, "uuid": "62ec8bab-7cae-44ee-98ea-55e5672abaa5", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864151, "uuid": "fe4c3bf8-3d8b-4055-9230-a83a780253e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864151, "uuid": "53f450e8-e036-4393-9e3c-d79675562fd0", "value": "01_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5095754f-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879396, "uuid": "d9792419-74a4-4398-b535-2c0d9ab536d8", "comment": "Malware payload (Dridex)", "value": "a9527ab63e4186ed788b5c497eb15f29", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879396, "uuid": "bf584ff6-cec2-4dfc-9226-a6153221388b", "comment": "Malware payload (Dridex)", "value": "a9553cada9fcd08158449709cc1656f4ffff9654fb99d2ca9350c6ae4df2bb94", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879396, "uuid": "c1479aa4-7b28-4ea3-9c21-386d59fa6889", "comment": "Malware payload (Dridex)", "value": "bd61f66bbe875b15f4114d483de58824798e3b21", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879396, "uuid": "557aa3ed-0917-49da-b659-1748e2e1cc30", "comment": "Malware payload (Dridex)", "value": "740921e9a4aa099de4ae16914f404ddd75817ecfe6f842eb072d3ddffa1446383a98dec8db72cf4d40d6374d06d5bb8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879396, "uuid": "99376044-2738-4d45-bb30-23e7b9272f26", "value": "8004B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879396, "uuid": "d5bab458-2e39-4d97-a9e3-d9e1fc58c476", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879396, "uuid": "871fc8e9-3321-4ac9-9503-9df26333e98d", "value": "3072:+WpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:+WpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879396, "uuid": "95f87f4c-7a40-4b90-b221-f7f33de583cc", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879396, "uuid": "2a9ad4e8-a517-4d38-aba8-42fb9ef015ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879396, "uuid": "7eb260b8-f3f6-4fda-833e-c489dd34c234", "value": "a9527ab6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41687490-bc8f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621860902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860902, "uuid": "606e97ac-a93c-4ddd-9cec-558b0107546d", "comment": "Malware payload (AgentTesla)", "value": "82f98218cbec987bcf36d651b768f899", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860902, "uuid": "9c8e3f59-b844-4bc6-a199-dc497bce0f6a", "comment": "Malware payload (AgentTesla)", "value": "aa5687fd10a0bc7589586e232dd6ccdf2c5057ced4368699f32c6d6fa0c562f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860902, "uuid": "1da8e87e-1ed0-4e4a-b099-dad5812fd5f4", "comment": "Malware payload (AgentTesla)", "value": "20c8b44896c7bf6f5bad447f69cfe605f34775ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860902, "uuid": "e7f481d8-7b34-4145-bb85-7ed9db52c0fb", "comment": "Malware payload (AgentTesla)", "value": "ef1c73a68d4de6ba7e071d37b39f22ff3a0de95d9ce551f2520f189d19ba9514ea35785280df63cfc7f7a74532764155", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860902, "uuid": "2cfefd0d-8574-4e0b-b74b-edb119c8415f", "value": "ACD4D06D7650B5AEC8239E318A745C1466EEBF729367C20B5017316C5E3E29F8E132B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860902, "uuid": "5ca63fd6-e617-4a36-96f3-b5f49f685cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860902, "uuid": "0d6802d1-99dd-4fb2-a6dd-7bcedb8d9b0a", "value": "12288:DlTPudTt1vMB0JOy9oMgkCki/X1AtXiFyCZiUf9iS6O08:FuvFMBQOym3kCkivmtXq08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860902, "uuid": "aadec7f6-191f-403d-bb75-99529f3a8b18", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860902, "uuid": "74055515-f18c-48e1-a05c-52848e27397b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860902, "uuid": "7220ba99-4840-4f90-85fb-df849e5229aa", "value": "BL Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1192c08a-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850514, "uuid": "750e83b0-bb82-4985-ad5b-f9b1683b74a1", "comment": "Malware payload (Dridex)", "value": "4ccc58f0205f6041dc69c001fec6b68a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850514, "uuid": "cc11de9b-3ee3-481b-af41-43f009cc8d3c", "comment": "Malware payload (Dridex)", "value": "aa9555223b9156ea0d1f467e2251650a206a392a46d9bba2eaf2ed9986f54245", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850514, "uuid": "e93871de-0a61-405b-a871-4a9b3f49005c", "comment": "Malware payload (Dridex)", "value": "59826bb17bd6f47392420e3cf374426d154a65c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850514, "uuid": "cf65a9fd-26cc-4199-aaad-f886da226831", "comment": "Malware payload (Dridex)", "value": "6b8e89372bdc3233d6480dee58996799b453ec4aff38cc65101f7433320d6f693719b8e2a94bf35525b707e7140b45ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850514, "uuid": "c6800530-a326-42a4-ba65-c8cef8cac8cc", "value": "D7F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850514, "uuid": "9722bf31-4fe2-41a3-9e11-071b85fb9c10", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850514, "uuid": "e9b82368-6e08-4132-81bf-556b56bdb85f", "value": "3072:HA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:H3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850514, "uuid": "d0a87a3e-dea3-426f-8b64-802dfc5a185a", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850514, "uuid": "bc58349d-cc01-4be3-8337-ce918e394d30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850514, "uuid": "31e77c00-1c10-4419-8cf4-10be9ee29d0f", "value": "4ccc58f0_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea773d2-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621850509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850509, "uuid": "c7894b93-24cb-4bf4-b356-311f7c4fdfba", "comment": "Malware payload (Formbook)", "value": "2edae93b279dd7483a37ec83a83d4212", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850509, "uuid": "5f79eeab-211e-4a67-901d-36360349a067", "comment": "Malware payload (Formbook)", "value": "abb5b9e1916667c4fd6aee3c478f57b92607b0378cc3d71c4640555562e359ab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850509, "uuid": "c02fe762-da48-49dc-bd0a-44d4b311c21c", "comment": "Malware payload (Formbook)", "value": "5b05896377330acb526b1a62c51875310ed6edff", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850509, "uuid": "dee3419d-1bec-4f2d-b11e-d419a838708b", "comment": "Malware payload (Formbook)", "value": "b59b3c59bbd236b44dce4d249b65b9d9f60d0883166dc63e904ff622222557a758d1fddb029481dbe2cc05af137cf4b6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850509, "uuid": "0ced80a3-81cc-4383-a2fb-f5790a539fa8", "value": "C9341255A3C5589FE0A74E36A932BB75E3F3EB045218EA8F67705FB709246939433082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850509, "uuid": "f8140cb7-68b5-4060-b605-21d9103ad67d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850509, "uuid": "3041de28-e3c1-42c3-bce7-644e35712096", "value": "6144:gsuFKaSVHQJrZvGXXHjtJQnh2QAtZQWDP:2FbIHOuXXjtMPs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850509, "uuid": "24af471a-6a7e-45d4-8115-7401b8f67398", "value": 241836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850509, "uuid": "642af632-0d90-4f28-b9f3-78d6d032a718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850509, "uuid": "d0db633d-8872-4367-9979-870d493b80c5", "value": "2edae93b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6101d4-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882854, "uuid": "dc20f7ae-195e-4387-98eb-fe9d16ac76d4", "comment": "Malware payload (Dridex)", "value": "955563cde10a89fd7765ec22abdc3a67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882854, "uuid": "09ad6dd4-0e25-4c94-af38-d84bfd0bfb74", "comment": "Malware payload (Dridex)", "value": "abc739e9ac5126cef947ee677bd158587cb3652b7be49634cc2ae990bba57054", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882854, "uuid": "5493bc0c-3e3f-423c-be31-79a0501e77ec", "comment": "Malware payload (Dridex)", "value": "3bbd3dd11688fc5eed7c9e6cca19bf8a0c8baa28", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882854, "uuid": "7d9c5fc5-88bb-48aa-98be-5013de052151", "comment": "Malware payload (Dridex)", "value": "7b7a2fda1e9ac9afbf7a75e0d127f19f0bf507f5c9c2f2b778f1485d3ead1849f998735f36631b81de9e6f0d09d8fc73", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882854, "uuid": "ecb17209-cb43-48bc-8048-18ea67ff0d58", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882854, "uuid": "208b60cb-82c9-4371-9874-c4432f38c767", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882854, "uuid": "be1dfd6b-b186-4694-b8ef-5ea8bdd494b3", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882854, "uuid": "1c75ba37-90ea-43f7-b97a-f19dcc811dc0", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882854, "uuid": "5318c77a-8086-4dcc-a284-4d0902b5d961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882854, "uuid": "6799f331-38a4-45aa-b8ff-03a8edcf291e", "value": "955563cd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365be2cd-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621850576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850576, "uuid": "ef4a7feb-d0f1-4ce4-88dc-63b16e24117e", "comment": "Malware payload (SnakeKeylogger)", "value": "a35668cda9194e9acc913698786ebdce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850576, "uuid": "97433a32-7710-41bc-b9a7-56d5ea33168b", "comment": "Malware payload (SnakeKeylogger)", "value": "ac81425293d072146e810b6b584333f09831ab5c1f3fe20b12f0dbed0913398e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850576, "uuid": "7212a2cf-7971-482a-a1a8-bfac4c0429ee", "comment": "Malware payload (SnakeKeylogger)", "value": "d1c944dcfac29d8f71920a9afcb8ff998f80c9b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850576, "uuid": "63d99444-396b-4dfa-922f-ea1c008e396c", "comment": "Malware payload (SnakeKeylogger)", "value": "c8aadc2c5158c4ab03f9bccc0215c8aba6bebece5eb43577613cfb2c9a178bf7b9f91890fa578dc59cfdec2b460ccae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850576, "uuid": "3639c0d0-98e7-4686-a830-9b188a1db059", "value": "15A4D03232CC9B59E87D67354161224053F4F88ADB33E759BDBE40E9363AE144A73A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850576, "uuid": "007b1e4c-4c63-4300-bfe0-63e2a1eea378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850576, "uuid": "30cb8ebe-a149-4f67-92c7-64e958b28d16", "value": "6144:322/7Ycthor9yfe4tiQkXm9fAiJWGbQMtNWbLz3hHi0vFtfAGo4W0HdqV9Xkpz:322/7YByi/Xm9L3QMtYvDNB3Yn84rKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850576, "uuid": "105b76dd-ac9c-4427-a113-81f3e3e11adb", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850576, "uuid": "d777e9b9-d82e-460d-965d-a91b9a79c428", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850576, "uuid": "c3f31038-245d-44ab-9adc-fa9b178bcdb4", "value": "qX1SfYAWTvOq08a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15350a5e-bc51-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621834199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834199, "uuid": "a485b12d-5269-4773-98a3-6b74390e9f34", "comment": "Malware payload", "value": "9d6aa4a2415f3f73dc37bb9a8480d672", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834199, "uuid": "c7e72e6c-72f7-4b15-a7da-89000d655354", "comment": "Malware payload", "value": "acb35cd59855c116cc7c3fd340cff61f4ca16e0eeda53916b6e0d3a65fbb49b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834199, "uuid": "de43073c-3ede-4460-8cfb-fa6f6cd2cf78", "comment": "Malware payload", "value": "e08334f11092d95e52483769a35d124010cda28c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834199, "uuid": "03b8f1be-86ec-4559-8888-fc6b71cd6f6e", "comment": "Malware payload", "value": "9c81f25d7f84b6772f0246ddf8708ce6399f6193893c2b45e9252f4a43ac0e934149a3f86b7ab630de931deb4e253c7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834199, "uuid": "e8e08230-a365-42c3-9f91-76e4e86a4436", "value": "0E34125562B4E1E3E29B8AB02D3865ABDBFA79031474834E3370E14DB966C91F80F764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834199, "uuid": "4493a6ec-a0f6-4fbf-b0fd-e364f36ab325", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834199, "uuid": "0134cedd-a0c6-4bda-99cb-a6b340be6e74", "value": "6144:kgORaihmE9rLFaOX48dgDFFQk1Wk8MdCwgFNrSaG:kgmxIOfdgzpdCwyrSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834199, "uuid": "ddc93ca8-855a-4e18-afb6-854c2b3e6874", "value": 237461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834199, "uuid": "8ab19f88-4433-443e-8b8c-7aeff3dce62a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834199, "uuid": "213b00d2-6748-4845-add3-cd06aa901ed5", "value": "Final Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f48df44-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850671, "uuid": "5ffdcac6-c510-41c9-9301-b8947a931412", "comment": "Malware payload (AgentTesla)", "value": "e52d22c2b72b142035d013bb94a624db", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850671, "uuid": "66ca1bc0-d0fd-47f7-a29b-dc79a5dbf022", "comment": "Malware payload (AgentTesla)", "value": "acde2ab860a161351f765b324bdbda9cc4a897c1b78cfa74befa785ad2f68ba3", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850671, "uuid": "f5da9691-a802-4f86-bca8-b3952a104e68", "comment": "Malware payload (AgentTesla)", "value": "048c8b5f396c6afb2a71b3ec517849879c11c113", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850671, "uuid": "ae991e08-6ee7-4a0f-87a5-60fe7124e29a", "comment": "Malware payload (AgentTesla)", "value": "5582fdf4f1571cab42fd3c4f86a4201116d3dfda13c8a1ab30f946e60cf3b4d71185a94e0487faf6ea6e8717d643ec84", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850671, "uuid": "362601b5-9798-404d-ac1d-b09f3f1cbaf9", "value": "A96423B2F55B1CE6D637972B2D68263011FC8B99EEDB6377940070842C5638EA5B930A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850671, "uuid": "90c1a03f-0b88-4ac4-9857-19df9b18fbdc", "value": "6144:NeFDcad0RQtu2nnUXmmtaxaXgDWmUw31uv4a734CLGuAeLg/zXHFKgZt1LdacUML:86aNtjUHgOhsFuAaM/uAeLgrjZfItc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850671, "uuid": "e4755783-22e2-4078-abfe-a79dd4d5280b", "value": 336829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850671, "uuid": "bf1d8d09-8b45-45d2-ae0d-c8721dd5b920", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850671, "uuid": "cc99e8c8-27c4-446e-9984-6eb7595b5d15", "value": "S.O.A.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24921380-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861283, "uuid": "a913f20c-6f72-4b91-9bc4-86a13ffd381c", "comment": "Malware payload (Dridex)", "value": "076ff48678315b2a1107e263cf7714d6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861283, "uuid": "7eb246fa-0dda-4128-b307-616241adaa33", "comment": "Malware payload (Dridex)", "value": "acf1ae73ba9432a98ee4f05bd1b3fa9ce52493c7abf6da3ee14e0c44079cad61", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861283, "uuid": "c060283a-d5d1-48a4-aeeb-bbbb0cf16f09", "comment": "Malware payload (Dridex)", "value": "ff8aafc647c649f94dc5090d91c6e334ee8570c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861283, "uuid": "9d6237b8-98cb-4118-b2f6-8222bf68860f", "comment": "Malware payload (Dridex)", "value": "3f636ea744ccde72ffcf6ad66c3d481f717b8436c53fc105b1bd28b9b6b000798248652584e2ac3ec9619bc019f509e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861283, "uuid": "4d1caba9-c07c-490b-816f-81a6833d6d93", "value": "3AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861283, "uuid": "ad4d2655-b1e1-4f13-b3bb-3739ac6b061c", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861283, "uuid": "0accfd63-a35e-41a1-b95f-23befc3fd83c", "value": "3072:wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861283, "uuid": "4d7ecdef-7108-43d4-a051-6737b9ad7686", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861283, "uuid": "e6ef4694-837f-48a8-9436-882076923383", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861283, "uuid": "008237df-70e1-4f11-8607-1301a484b1e3", "value": "076ff486_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cd775b-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890141, "uuid": "5e5a1201-33ab-4ca7-8140-7564ef7a5294", "comment": "Malware payload", "value": "bd61563a2f4546fdcd4c5046a10cbf28", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890141, "uuid": "d939cb8c-a878-4340-ba8b-7cc46ed00598", "comment": "Malware payload", "value": "ad18508a94d74b6f746b0ab43d26ba2ba9c63708bcf8f376aa307dbbdd338d19", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890141, "uuid": "4a883e44-0469-40e6-afd3-cfed6e4b19cd", "comment": "Malware payload", "value": "ad877277fc042935f8bc7f049db63baa2b38f8d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890141, "uuid": "7208c7aa-2fe7-460b-83e0-2effdc21e108", "comment": "Malware payload", "value": "776e3982e59005bca6a4cfedb672288b944c9018ccaabf72c03f56661cd07844b163ba6e324004e04de76cb97d668ecb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890141, "uuid": "c26ba7e2-e85f-4075-96df-e09472323d9e", "value": "27F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890141, "uuid": "90bea9c8-3abc-4b89-b85c-85f2f2f1215e", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890141, "uuid": "a05f2148-0da7-4eda-b089-4f913826e8fc", "value": "3072:Olpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Olo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890141, "uuid": "43d2b08b-82c2-40ef-81cd-56f9d2ea56f8", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890141, "uuid": "39fb8250-a4aa-4d06-b6d9-c62d6e799537", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890141, "uuid": "b2d20f0c-17a9-46ec-afbe-1e68c633456b", "value": "bd61563a_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d87c30-bc6b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621845359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845359, "uuid": "7cdcae67-f729-4970-bbd5-d2acfb7d9438", "comment": "Malware payload (AgentTesla)", "value": "1e1c2985c153e1c62ea1149e9e7b64d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845359, "uuid": "f3e5e76d-8ecc-4855-8889-45a2a57b9049", "comment": "Malware payload (AgentTesla)", "value": "ad5e28f8cce65652f4f60d135b6006d0e1cccfa632f7ada11f60c6d4f7a4a18b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845359, "uuid": "3f26d965-86fb-46bf-a4b4-74cc52cfc638", "comment": "Malware payload (AgentTesla)", "value": "5e6ae71dffbc9d7c1ddc0657c0d400117a327cde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845359, "uuid": "8330ee82-726f-4e8f-81e5-bfa539504c6b", "comment": "Malware payload (AgentTesla)", "value": "e626374b809ce1d93c17f5c1fc07b2f9439197eecce5cdbf4e8f302a41370b9044e7fe0866f4c77f08df448d1453133e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845359, "uuid": "c9d268b1-6c17-406f-ba6c-ac1801e7f060", "value": "D0B4DF6D3794B5AEC477DE72CE701C209B20B467572BD20BA45721AC9A0E6DBCE107F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845359, "uuid": "e1c6cf1e-4633-4193-a6ab-fb61ff620b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845359, "uuid": "99ccbf82-7a32-4927-8daa-c271c4b08fa7", "value": "12288:ApnsYsdiQ7Xe5DRyggBRLrXExB8OOdqpV/pfT:QsdiQre5DY130QW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621845359, "uuid": "9af8bee0-a8d0-473d-a966-eb3ca589c99b", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621845359, "uuid": "467397a2-92ed-480b-be94-66e640e5635c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845359, "uuid": "79ac90b1-453e-4d7b-ae4b-d150040b0b63", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dc5b9a-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846918, "uuid": "b0c60f0a-2aeb-43d2-8f98-4452dc5e0bda", "comment": "Malware payload (Dridex)", "value": "5f41ec63c7b418c497ea3e564131b7b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846918, "uuid": "d971f369-0fca-4638-bcd3-fd0d75f72cec", "comment": "Malware payload (Dridex)", "value": "ad6d097ac7a78587621d83c0275d75ced2c883599d12230d9b9e59499969e81d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846918, "uuid": "d6cbf041-de10-4746-9098-4358109adc3b", "comment": "Malware payload (Dridex)", "value": "08794e8395ab4564b4b942c4efd9dc7abd45a460", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846918, "uuid": "079d5cd8-476f-475a-826b-00e4d524bec3", "comment": "Malware payload (Dridex)", "value": "d2512211eafcd58b61b07277f4030162f18296cccc255a052445519414b69bc8fe249d5558c738520a822c6aa24496c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846918, "uuid": "4e301c0d-6f27-4660-8f3c-92df88545f4c", "value": "96F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846918, "uuid": "282b0b59-6378-4546-9e34-dae805463672", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846918, "uuid": "485d489b-4060-4110-98ff-16a000499dda", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846918, "uuid": "8c8f45fc-baf6-444a-84f5-ae09daa9013e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846918, "uuid": "de1468c5-ab5c-4bd2-addf-d61a84d60b38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846918, "uuid": "ec9d0eb4-fbf2-43b6-a189-a81f48e810c9", "value": "5f41ec63_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8906c46a-bc8e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621860593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860593, "uuid": "c238f1ed-6dd9-4e8a-bee7-eb7e3ae5f164", "comment": "Malware payload (Formbook)", "value": "e4225704b5fa15925cf61d47a9564228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860593, "uuid": "a58e3adb-cb35-451b-bbb7-7b824e789d5d", "comment": "Malware payload (Formbook)", "value": "adc50d637d48a25c809ee9e8ee791830d978d45f6cf781b917b8d88788363311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860593, "uuid": "df1ea924-13cc-49a7-8d52-4d7c41bad5c9", "comment": "Malware payload (Formbook)", "value": "4951b10aa7884c2dbe81970f4582bee62e26bf80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860593, "uuid": "499968f5-6ec3-4d11-90f0-7f817f9a338d", "comment": "Malware payload (Formbook)", "value": "92bf94de41ccceb59c3a628d025d63e38ce932d11b89586ab7a62e791679855f11caf31ceca5d178b0b5198757296c1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860593, "uuid": "634db198-4361-4447-ab83-079031b1fb21", "value": "C735E21CA129A132F468C63905D3702BED18D7736021AD95AAF7075F2F37DC0BB8A5AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860593, "uuid": "4cdc1dbe-ec81-41b6-94db-83fa4ab5b134", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860593, "uuid": "bad672f3-6532-4ea2-b25f-5584dc94b705", "value": "24576:NqZYx2bEThqrByxPkmY/yMa/7fVLfHHzKs:dMro4yMa/RLfHes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860593, "uuid": "f965e3e2-3aeb-45ee-ba52-50db2a60816d", "value": 1092608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860593, "uuid": "fb77d9e7-8617-42b8-9917-7e059671fc6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860593, "uuid": "81040ed6-9d4c-4463-a41d-b2d76d2f4ecb", "value": "P.O #RFQ7787HG00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d391334-bcb2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875928, "uuid": "6f7423e1-6536-41d8-a995-47b49a3d6bc7", "comment": "Malware payload (Dridex)", "value": "6c717ca20146e25785f9b00569a01951", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875928, "uuid": "33849e2d-b854-4896-b006-45a6f633ef5e", "comment": "Malware payload (Dridex)", "value": "adf7927f2b0eca1416125d21f0890c23738fc169853f1ad5ce2154365e104e96", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875928, "uuid": "e08a903c-e373-49f6-923a-8e0bd47a77fe", "comment": "Malware payload (Dridex)", "value": "1f2db94e7cf74f04afa01640c2a8acd1c6815051", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875928, "uuid": "46e9d472-f4ce-4d4e-8af2-de28c267c84c", "comment": "Malware payload (Dridex)", "value": "2f13f15450b32bc4c7d33f353c2a35dc813f971b88e7919bd14cc4090e9527964764ed7be7843c96be1af055e764aac6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875928, "uuid": "e1f12f8c-c6a8-48e9-9f61-78f5c90af5bb", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875928, "uuid": "f08091f4-14eb-4cc5-bf10-33a33d07a51e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875928, "uuid": "5ad42109-6835-4f4b-a660-cedb71ae9d8b", "value": "3072:umNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:fLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875928, "uuid": "6cbf005d-7a58-4790-8b6b-c9d35971af09", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875928, "uuid": "ae0026c4-4750-43cc-8a3b-724e51150ca5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875928, "uuid": "693750da-009c-46cf-b378-48c60a542a44", "value": "6c717ca2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af59a665-bc8e-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621860657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860657, "uuid": "0a9a3c7a-b37c-49ea-912d-0d0230102d86", "comment": "Malware payload (Formbook)", "value": "15e8e47561a1d4dd26c6ac339b34da71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860657, "uuid": "eab5cde5-301c-4d61-8e04-f581825f924e", "comment": "Malware payload (Formbook)", "value": "ae5df8905dd1b9de509e6764dea4c5571916b1705a129bddf2f5e2e554552acb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860657, "uuid": "7ed06ad1-39bf-4704-9f0f-22b3d3b66a7a", "comment": "Malware payload (Formbook)", "value": "15066f6d3e8967dbefc48440c0fd305b0f62482c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860657, "uuid": "0f884842-60d4-4321-a875-c5f75c341d18", "comment": "Malware payload (Formbook)", "value": "661f1eb1537964ff5eb116ea74ce817075deac4713d981bb0c483b0b39c51ed22915c9583d9ebdf38a7911909ac7815b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860657, "uuid": "a51dd8ed-0307-460b-968f-d203d650019c", "value": "3F3412BDE1D69CBBE60589760A73C72FDBF59B5032422D8F6B155FAD2E1008394123A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860657, "uuid": "9c2f1c97-9772-478d-bf89-a25ca001696b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860657, "uuid": "bd21c775-58c8-4a28-89ba-4bf3a9ff51af", "value": "6144:Ds9g2Za/I2DY8u8dKU1u74+cz0uKrJ/2UU:ygj/IvB8kQuaEl/2UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860657, "uuid": "19e1a645-eea3-48a8-ae30-1833d2b5715c", "value": 234900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860657, "uuid": "40b7da17-be45-4688-a040-9983e8c639ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860657, "uuid": "5518aa76-fc74-4365-8415-e0ad46aeaa87", "value": "yy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad99690-bc54-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621835873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835873, "uuid": "e8f2cca7-d405-4b65-adf1-92f6e35bce92", "comment": "Malware payload (AgentTesla)", "value": "edeca92226d530580e831d3cb7e1d772", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835873, "uuid": "d38ca33b-0c0a-4996-abfb-c730d6c6478e", "comment": "Malware payload (AgentTesla)", "value": "ae6f8c9c11bba7d0ce66f3560ceb6fa1d9b3ca9dfa9e2973aec4f35ef0c81bbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835873, "uuid": "94f492b3-1b82-4952-87ba-2501c3ea2338", "comment": "Malware payload (AgentTesla)", "value": "579e9c240c1ed0b1d4453d117a388e2a731168c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835873, "uuid": "1da878b7-50e9-4267-b69e-5bec17063a20", "comment": "Malware payload (AgentTesla)", "value": "9271c39b159a60d8a404d765fb726b33bd51f26e816f7164193b5a828b2151ea2de54ec7c3e24dedcdd443ab075e15d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835873, "uuid": "e8bbcc4d-950d-4e21-8084-91e8a0c752df", "value": "0CC42383E13C8045F8E5C606056E26DBFCA0BD767AA13B6DA174A3641F3DEE55832723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835873, "uuid": "8e4d9b6e-57b4-4f08-bcd0-36e72d3cf546", "value": "12288:dOL8FIXs9cIuHLjL/oZbe6DIF73eqYHLxShGEks/7vh6AL:dM8FvO3UfQPExREZ/7ZhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621835873, "uuid": "a2d077da-d89c-462c-8570-a2398b05e318", "value": 582207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621835873, "uuid": "aaa73453-d2e2-4275-a059-a7c7f56f23f9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835873, "uuid": "ca93082b-4751-4e76-a135-1afe594373e6", "value": "Shipping Doc..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92107e11-bcd1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621889384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889384, "uuid": "1bd55ec1-ff45-46bc-ac1c-68f5d1e7ca1e", "comment": "Malware payload", "value": "f2ec585060d36ba385a06d053effe32c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889384, "uuid": "6ac6fc79-02fc-4f32-b1e9-49c544d08d7e", "comment": "Malware payload", "value": "af37541da5e2d0122834a4f1b8debc68a56a5bb674fa34519d7bf25be0357132", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889384, "uuid": "05a78566-3788-436c-b92a-440c96ad807c", "comment": "Malware payload", "value": "fc1b83a81dd98fd7bb64b422c2d1243b6b7bea21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621889384, "uuid": "1587e5ee-0ea2-450c-84d5-b6e0972ef06a", "comment": "Malware payload", "value": "3838d27f190434111738fff6bce662c6ad8701eece6823f1cc30a2d01d5ae8fec5e8b1b57905e0add216dcc5d6fd6dbd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889384, "uuid": "eb17d6ee-39d6-46e8-967e-55540807d05d", "value": "30257A532EC1DA8DF2D8097D81FD1012BF53C8C2990E9FC699DB73AE19D2692F522907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889384, "uuid": "b6ccb4a1-69ac-45b7-9e94-f4d9bffd9ef2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889384, "uuid": "489fd246-84d8-4d33-aefc-36dfe865cfb1", "value": "12288:52eMkm8WJm3wN9Fjbd/boj28/SeZrNGFrXnzsw3d3VboFaensOvRFGhJh1s4Lms:0Zkm8WJiQ9Fjbd/boy7FFbyBs1s4Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621889384, "uuid": "93ef3565-7df4-4221-8877-f7bdcd5e1904", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621889384, "uuid": "422fe454-fccb-40ac-a75b-39a69035dc1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621889384, "uuid": "b0805101-0311-41f0-85c8-2015db40bde3", "value": "IMG-SOA P&L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea41fb3-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621835906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835906, "uuid": "a6634839-60d8-4a61-9d0d-7377bf21c677", "comment": "Malware payload (AgentTesla)", "value": "04e88d9d51d1c0d9e68c4b2cd0225688", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835906, "uuid": "3be97de0-1a8e-4c17-8372-2ee3eb2d9165", "comment": "Malware payload (AgentTesla)", "value": "af6dc30fffd664bf2a87201721a174fba555b063d54e47793b1274373b00bdd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835906, "uuid": "98b1de30-af17-45c0-87d2-5f8248e73231", "comment": "Malware payload (AgentTesla)", "value": "026e907c2b274e2de66906057d27324f5cd62f0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621835906, "uuid": "74a43037-1778-4e0a-9476-a16f40d048f1", "comment": "Malware payload (AgentTesla)", "value": "3d59ba72d2c0af64564a06cdc11f8f17ff20e91e138385de5ecbc3f1a48eacf95d1f0eaa19208958c1342f66eaaaaded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835906, "uuid": "bb10a24c-2b1d-4a90-94f7-e1879b8d727e", "value": "42E4330878965D0C6E694F2438EBFDE9D9098CC737CB70F549DB10AD205A9B104EBEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835906, "uuid": "2a647992-dd8f-47e6-9728-09f7de18e9a8", "value": "12288:RWeo3f2c+WNjZkVj6mKF2HvizIPvgNSO92bGT1y36qNuYTQb6gqo61J+qAmh5gQO:Yeo3ff+WkjKM4SvgNSO9P1y3dNuoyWXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621835906, "uuid": "2b856b31-e592-42bd-b809-0403068b6f71", "value": 712735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621835906, "uuid": "fb822c98-6f0e-4ba6-ad9e-d7d54f7f9d64", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621835906, "uuid": "0571bacb-d9f4-4948-8619-bab455e689c7", "value": "Order Comfirmation & Spec IMGS_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db0af98-bc9b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1621866077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866077, "uuid": "2cdef63c-e342-4334-833f-1072f0ae1711", "comment": "Malware payload (Loki)", "value": "581ccff9a4dd485ac37399b5b563d4df", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866077, "uuid": "61e8aecd-25d6-44d0-92e0-c2af3f94ad93", "comment": "Malware payload (Loki)", "value": "afb6ac1bd79aef042c365616dc6f0803ca0038012a3778dec42f511447c3a6d3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866077, "uuid": "a81fc6cd-7ade-4d7c-8089-1fd7b3596be9", "comment": "Malware payload (Loki)", "value": "448d673e832ff93874765b2bffa558f548ef6063", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866077, "uuid": "720f480d-be83-4e10-b0a8-469ec52190fa", "comment": "Malware payload (Loki)", "value": "ad19a74f7d82c348f32e2b009763f0cf5252e63ea00cf1d56478e501bd526408d478f7a296b856d4c0abb81632a2bd1f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866077, "uuid": "3e375e3a-d052-462e-867e-ebd9f754f818", "value": "01E3125869199DCBCA64B137BE1400F915E98B28EC2FA496F27D9188A316F0D4C7F4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866077, "uuid": "1fbc6da7-a7e7-4100-9ae7-810f274220c9", "value": "3072:8AmBAo6YpWmeGPzr+CwX9i6HoHUPx/KdbOB9Eg9XC3xTnhc:OBAzmeUziVtiT8/sqKxTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621866077, "uuid": "0fa3c2e1-7b20-4dab-9689-2ee0b1ce131e", "value": 147170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621866077, "uuid": "2ad4d8d8-3dcb-4056-82da-b138fcfacbdc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621866077, "uuid": "71e09272-ce12-434b-905d-ca39f5c6fd21", "value": "PO New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26454ece-bc78-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850978, "uuid": "c1e85db2-c8e5-42e1-8417-8c2f3287ecb2", "comment": "Malware payload (AgentTesla)", "value": "ef1b96301358b5671a48d5a7f419f7ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850978, "uuid": "f8012ece-0339-42f0-9c58-52f7443ebcfc", "comment": "Malware payload (AgentTesla)", "value": "b0363b733a3bbeaa855b76adb25239bf2d96e49a6453c687e1a2776d1b818b1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850978, "uuid": "83228069-7688-401a-9fbd-76e2178f436f", "comment": "Malware payload (AgentTesla)", "value": "3067b0f113a03a81062c90f0981fd65dc4f5ce6f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850978, "uuid": "ff308bda-e209-430b-a031-e07dab28768e", "comment": "Malware payload (AgentTesla)", "value": "7f7c90e8bbc83612847dee61bc465e7eb3df1c171626150fdbd8204d098fe4d05c4ac2eb746cc15988c84b4372549a11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850978, "uuid": "2aa1cfe8-ddf1-4884-96a0-8ce0ee7f1eb7", "value": "2DB423D8F3F3BEAC48911A26DDC2C3C664F758BE95DB6F7465248F3600C156CA2AC189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850978, "uuid": "b7b7ea54-bb67-46e4-971d-8ef94f249793", "value": "12288:IHwxTfZBl3p4WG+eZ+j1VCJoMQxLV7Vilrx:IQBfhOWSZ+RcoPVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850978, "uuid": "5542caac-7aef-42d2-b209-2cdb9e0c1468", "value": 498770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850978, "uuid": "8816b7dc-e259-47e4-abba-85aa7d8b9b22", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850978, "uuid": "497edb54-ff3e-4e45-8bc5-b6473434f916", "value": "Scan 20210519.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fab524e-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818057, "uuid": "f9720820-3baf-4e03-b9bb-316b4cae6149", "comment": "Malware payload (Dridex)", "value": "7c2a8092c537a496e4b471031870227d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818057, "uuid": "f32983d5-a840-4dd6-b73e-cd2e2991f622", "comment": "Malware payload (Dridex)", "value": "b075fa177504d96e399f3a22cf8115a798f82ed94bd77c2bc36e1749e9065f16", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818057, "uuid": "8af6e3b7-6eb2-4f7a-8b4c-90c2793216be", "comment": "Malware payload (Dridex)", "value": "cba17d68f0c18091face4bc61482bbad1596f11b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818057, "uuid": "f7fdf52c-f5e9-4ed2-9aa3-2dfd98242260", "comment": "Malware payload (Dridex)", "value": "fe10f61974233c07aad9791ae0d86638aac84b8cd3372b8cb33c6028e6670a1186902fa65d4800902e1e14657e5cdf8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818057, "uuid": "5ad45889-e586-44a8-9efe-ee7b87e13fe0", "value": "E004B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818057, "uuid": "79025939-6415-4924-8076-a36cb8dfb68e", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818057, "uuid": "2bb83189-1d53-455d-a557-fa3530f4118d", "value": "3072:TWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:TWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818057, "uuid": "fe10ae61-be8e-407f-bc43-52f821082d4f", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818057, "uuid": "7fb3d634-20b1-4cb7-9f0b-fd658a5152a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818057, "uuid": "a356a367-e9fe-427e-b088-d4e5119fd5ca", "value": "7c2a8092_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7402f19-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886440, "uuid": "fff36504-4bd8-417e-8d1a-1570601a42f4", "comment": "Malware payload (Dridex)", "value": "a2b3f8ed105f44d8d764e67edfd95de0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886440, "uuid": "669bf965-b729-4ee7-a3fa-40208cd8faf4", "comment": "Malware payload (Dridex)", "value": "b09fe75e172c8b071d9a5f845aca0518211527c7f1df06a9a49b643c5c1a5f7a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886440, "uuid": "12f70c46-e2c9-4a5f-b47a-62bb8a71b368", "comment": "Malware payload (Dridex)", "value": "a4245ee54a0fdf1386932f5e32e66ac3a11b02af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886440, "uuid": "9648663a-19bc-4894-82eb-49690a98bd97", "comment": "Malware payload (Dridex)", "value": "5e652add6fc47031ce47acca716a5a733b6bf7ad89521957fd9b3e05802bb3fa126f0e3d4dded3081958a57da22fb58b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886440, "uuid": "1a4a028b-b039-4906-8b0e-5021a40ff0fb", "value": "F4F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886440, "uuid": "7e714859-557d-440a-bfdd-19a1e4fbb539", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886440, "uuid": "ae760022-700c-4e90-aa53-119a520ede0f", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886440, "uuid": "8336a48a-4af5-4e28-82c8-92bca7509350", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886440, "uuid": "09f9b437-eb3d-425f-a211-b9af0f4ff673", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886440, "uuid": "f53627ff-3aa0-48ff-915f-ce9327291f59", "value": "a2b3f8ed_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e6fe4c-bc34-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821750, "uuid": "271594b0-4010-4379-b82d-7247a4edb9ab", "comment": "Malware payload (Dridex)", "value": "ac8692f812f0a44d957cb0177a366a6d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821750, "uuid": "6f4a4036-cd2f-4634-a43c-0518584b3849", "comment": "Malware payload (Dridex)", "value": "b0d8a5cd55a317d22daeeb62b9ed47896bcec94f155abeb961fd0e4f90254069", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821750, "uuid": "f29756c3-99ed-4a4f-b37a-8c963db23735", "comment": "Malware payload (Dridex)", "value": "aa70efdbe77794b534f39db44f7e906fa4f14018", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821750, "uuid": "ad65b5dd-f7d0-4027-bcc1-9cd4fa3726e8", "comment": "Malware payload (Dridex)", "value": "e254abc9a29bd3637db7b3cadd0b6888b97ee5a93475cdf28ae2c970f437315e9712f3dfc507b77533825db2e46387eb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821750, "uuid": "2a86b399-3106-4d24-8082-03d5bdeb205f", "value": "2404E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821750, "uuid": "4eaf4afd-12eb-4789-b361-1d0dcc2f5876", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821750, "uuid": "a3cf318e-96f0-45ea-871b-4e97ff8ba2c6", "value": "3072:yV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:yV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821750, "uuid": "519d48bd-b3d7-4d92-9bf4-43bd3aacccf0", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821750, "uuid": "9958f730-14e3-46ca-99aa-1e94824a3fb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821750, "uuid": "94594c60-cb7b-4398-b7c0-6e7ecb88bead", "value": "ac8692f8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33984f09-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621886649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886649, "uuid": "c215fc92-ec88-49d1-a9ff-d603431d4f1d", "comment": "Malware payload (Quakbot)", "value": "786a92cf1d0b3683eceb3f8ace30086a", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886649, "uuid": "ec4393f9-2fcd-42cc-badc-acb7356659b5", "comment": "Malware payload (Quakbot)", "value": "b0f5dacf46c29672878becdd25fb6bf0f2e1d34aa48ff14c2326ec122b4710c7", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886649, "uuid": "5c6bd9be-75db-4a9b-ba53-a31176c5146e", "comment": "Malware payload (Quakbot)", "value": "2f5b41429b38ff3a2f889a3d0ed7224e96e0cf25", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886649, "uuid": "e1e9b62d-ce73-4b37-9974-efb223e2f26e", "comment": "Malware payload (Quakbot)", "value": "f8eb01f0e145749084ab212705152eec333799942c483cf6506484b2b726cf8db5006b4b4fa0d547ab51dce020322784", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886649, "uuid": "d161265a-9f2d-412d-b4cf-38b3ee11e37c", "value": "B584026327CDC142FBAB0F3FB627A96055F5AD871033923A12C075A8FA7293418D6B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886649, "uuid": "c7f0d30a-37b6-4c2d-8097-05a99eb30e10", "value": "820e38a216f0e9400bddb6a6963c8780", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886649, "uuid": "68754d84-75ad-40f1-8d9e-65cbb1b6ddea", "value": "6144:nX1SoZGQIJ0xMnfQ/UELAWm+XXgNvThy+dK6riexJV0F:X1So0QIPfQXm2QJhyd6+exDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886649, "uuid": "87d92435-a338-438f-88a1-0a4485f1d148", "value": 383408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886649, "uuid": "c3e4e9c2-94ce-42b8-8f1f-3c1f3d25a8c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886649, "uuid": "eaedbdc3-c0a4-45ca-97fd-6b0e169aee9e", "value": "786a92cf_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22aa591-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857682, "uuid": "0c4a1e9a-bc84-4b87-9195-b550091f18b9", "comment": "Malware payload (Dridex)", "value": "82b323e8baa13df1ef41b183aa7210fa", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857682, "uuid": "6d5886d8-ec55-4260-9e78-68bd984eabab", "comment": "Malware payload (Dridex)", "value": "b1291033f39c9e86d26d5f9e47e50fd0102af5faefb060bd648ea0a73c2e3077", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857682, "uuid": "e12b3f8e-1a98-41cd-a077-7763e63d5a2f", "comment": "Malware payload (Dridex)", "value": "65725ed15a0eba009399314f889309ccda5a693a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857682, "uuid": "db636458-ee83-4da1-a684-703722826680", "comment": "Malware payload (Dridex)", "value": "31d1aaad23fa96cf3eca781747ae4e939f709843334841f914782ff5ab8cde4b3a4f2c8656c70cd89c713a17e9bb9a1e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857682, "uuid": "63eee500-8c07-4fa6-870b-d9f9cdc6f976", "value": "07F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857682, "uuid": "514e8fa0-4015-44d3-a77e-39dc88301e4f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857682, "uuid": "aabaf153-ee44-44a0-b3b0-921ed6bc4898", "value": "3072:smNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:1Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857682, "uuid": "735e9d99-cd3c-41a6-bafa-e4d02bf48e43", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857682, "uuid": "6929f4ba-ec94-48ae-a570-ebfb80564cef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857682, "uuid": "e36a0f8b-2a87-4954-9088-634c35f03c0a", "value": "82b323e8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66733a7-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857690, "uuid": "fd623fa1-f779-4e68-9734-7de2a3ae9064", "comment": "Malware payload (Dridex)", "value": "815374b992425c1c96473961192c98f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857690, "uuid": "5f6ab48e-d380-43e3-a785-b7ab090c0ed8", "comment": "Malware payload (Dridex)", "value": "b13da5483f2526af8020f511289389451f6a996b50883f506e8fa8543d62cf9c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857690, "uuid": "190fcc44-bc16-470e-8966-249cf36151de", "comment": "Malware payload (Dridex)", "value": "f1372d1e2dc9f377f09019433ad7a76678e71edb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857690, "uuid": "a298023c-239c-42df-89b7-13d3c815ae53", "comment": "Malware payload (Dridex)", "value": "daf42f3c0bddd51df57a177ab9ad7ea6043fe6e753002d2307434f02614178e12cb7082ee56ffff40bd088fac6f417be", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857690, "uuid": "8f1da42a-30ec-489e-97ed-83e71ca7fc4a", "value": "B2F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857690, "uuid": "77ac045c-be7b-4c3c-ab60-b63eb2df2379", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857690, "uuid": "59315a08-537a-41e8-acdc-2d06b9c78a32", "value": "3072:NmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:sLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857690, "uuid": "01e3746d-9f88-4238-baa8-d64c8a7ff318", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857690, "uuid": "3ae516e6-4096-4f76-8919-e12a5c132ab9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857690, "uuid": "0602ee97-aaf6-432d-a1c4-c8008ee358cd", "value": "815374b9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7648f9-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843312, "uuid": "44f2d358-a29c-47b0-b6f0-be5658758562", "comment": "Malware payload (Dridex)", "value": "28b50039a2abb0540e8beaeda3620185", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843312, "uuid": "1d8a2a2d-c8e7-48e5-9b18-5aa465fac90f", "comment": "Malware payload (Dridex)", "value": "b1985d877af1f5c6ae885507791ce0556e579eaad69c321540dfaadf79d8c0cd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843312, "uuid": "aa3b4070-132f-43b0-ab32-fe136c3107a3", "comment": "Malware payload (Dridex)", "value": "4a809ca0788f1a27cc452dba60688eb095ff9e17", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843312, "uuid": "742b0b46-2420-4048-bd11-ee87a1cff72b", "comment": "Malware payload (Dridex)", "value": "9cf9706308a8db08dc6846523cc2c524159f16c1686d93f9d680994aaf5bbac13ef398c62cf9a0f457967d9c4fa31ca4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843312, "uuid": "42d36ceb-0fd7-4a9f-89ea-b2c34fcb9f50", "value": "82F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843312, "uuid": "f6746cdc-becd-4d44-9372-304030d4f1b4", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843312, "uuid": "c9182ee0-1940-47a3-b432-d7e7796e3d9e", "value": "3072:PmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:OLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843312, "uuid": "8a7877dc-ca3f-4fb8-9883-e365a9f910f8", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843312, "uuid": "96739eb8-2267-4b43-9672-a3926407d945", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843312, "uuid": "c8fffb96-95df-4474-93c6-b882c90fdfb9", "value": "28b50039_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bdd504-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621838415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838415, "uuid": "0e6adeff-5594-4a76-89ba-f956fd4fabab", "comment": "Malware payload (RaccoonStealer)", "value": "1bca4dc5e5e8618b1862b205bd8a79a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838415, "uuid": "55000e65-505b-4e50-88e8-f593ed77f627", "comment": "Malware payload (RaccoonStealer)", "value": "b23210d4b7ea06f808978b02de2813eb5a61a3aa96f69c9748855042a3b732a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838415, "uuid": "fb0b89e4-4092-45f5-ae89-6903863a46dd", "comment": "Malware payload (RaccoonStealer)", "value": "317dc66f515358df6ade0bd91998f94091a07dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838415, "uuid": "24dd67fa-039d-4c92-90fe-60bb2b60372d", "comment": "Malware payload (RaccoonStealer)", "value": "68fe4f5e4c86b843ddc2c9b65973334d249733ebc5167ce31042a36280d1f15f233b69e0c2a4f60adcbcdb1aafe61be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838415, "uuid": "616e7225-56a6-4826-8ec2-158f0c02cd5d", "value": "BE05012066B1C034F1BF11F049B592B8A52ABDA07B2480FB62D136E95BB5DF49D30B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838415, "uuid": "d8b7d342-93ba-4a7e-b1b0-0df25ba68ebf", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838415, "uuid": "d9596bac-944b-4250-8682-074d71da91cb", "value": "24576:JetvbSki/1w23rRb7IKzVZKj42gatBTXsL:CSkiNw21XFzrKjftJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838415, "uuid": "966c5b6a-5e0d-400a-b4de-4b29d5828b39", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838415, "uuid": "2edef61f-ebdd-4890-affd-30302c271ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838415, "uuid": "f0eb777e-67f7-4a20-8202-7b7d5fca435d", "value": "1bca4dc5e5e8618b1862b205bd8a79a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca19fbc3-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875735, "uuid": "dd425e82-6b30-47f7-a6b9-7a70f49fcb40", "comment": "Malware payload (Dridex)", "value": "4a6bd1869ec4c69d7c5fc54731de7d0b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875735, "uuid": "f44dadfc-09ba-44e2-8825-12447fd4a7c7", "comment": "Malware payload (Dridex)", "value": "b26384c2f6b3da1a40a8afce2eff8babbf3a5ed8bdb1eff8847557f735fd026d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875735, "uuid": "5dd51e6a-2df3-43ae-81ec-1d2e4fdde4ab", "comment": "Malware payload (Dridex)", "value": "c7df6fb0e82afba373987a6f8724160901c42a67", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875735, "uuid": "38528db2-52d2-44eb-9633-f555a91a471b", "comment": "Malware payload (Dridex)", "value": "751190308db970861b362dd6b5e246068d344cb8066e3459a6a85d1dfdb20a04e872aa6830243c1a993ce7ee7066cd23", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875735, "uuid": "2ab41e61-4d7c-43bb-8f1d-f032cb7bd815", "value": "1AF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875735, "uuid": "a1952abf-eff2-4b2c-9bb0-37ab6a982a53", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875735, "uuid": "daac9fd1-4198-47f1-b698-8ff452aabb71", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875735, "uuid": "70fd28cd-4361-4f58-a67a-a3a2e6ec76a9", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875735, "uuid": "36f38bd6-486d-4e69-a2a9-33c984880c0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875735, "uuid": "37a75767-e986-485e-8d8d-d6f7c87e022c", "value": "4a6bd186_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6431e9a9-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882865, "uuid": "a412877b-f9c7-4c99-9768-296c1a54dabb", "comment": "Malware payload (Dridex)", "value": "075e7804c6b3068b21282282d5be6fb2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882865, "uuid": "52b94b4e-c020-467c-915f-171f5a60ee1a", "comment": "Malware payload (Dridex)", "value": "b284aed1a27bc09ea4e5ba7c98a445a3a71e93cafa71ab8177444c45ef356bc3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882865, "uuid": "75c3e315-0d51-4d67-af91-94ea83961095", "comment": "Malware payload (Dridex)", "value": "3611ddf21b8fb9c6eddfa60d42c5280714745cec", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882865, "uuid": "f3b5a0fb-2a66-4cc5-9a05-1c0ae8f1e37a", "comment": "Malware payload (Dridex)", "value": "a11000c30e6c1a2dc36582788cf64558dcd7f7ef7b9a183cf8f83107c842182fde0697fde87023ee6d003ffaa9a79e69", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882865, "uuid": "a8c2907a-bb4d-4977-9749-1f071fb2afbc", "value": "A8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882865, "uuid": "218b1853-ba93-418e-b55b-aa9d688b6d6c", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882865, "uuid": "224a95e5-93e6-4b77-ad59-13e316089ddb", "value": "3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882865, "uuid": "7a5a0033-8422-462b-9a3a-0cc26b160819", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882865, "uuid": "34cd5adf-6940-408e-8e2a-3354500fdeb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882865, "uuid": "7698e0fa-b5a2-4839-8b7f-0f00be2f9ed1", "value": "075e7804_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df86f879-bc5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839693, "uuid": "de6f0903-6c7d-435b-a52b-f6a8ca69db40", "comment": "Malware payload (Dridex)", "value": "5bf1ecbe818d8c67e1ac7dd7f14f4f14", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839693, "uuid": "fb6fe61a-5c31-4ae9-93b2-f987a55de6e6", "comment": "Malware payload (Dridex)", "value": "b2a193600759e9f83f96ce116a984a2dfd54ccd95981b665cc7538143fa99273", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839693, "uuid": "612774f3-5779-4785-8953-4c8d44405bb2", "comment": "Malware payload (Dridex)", "value": "07ff1c89259a1709efbd268c6ce382f9a8e82e82", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839693, "uuid": "a3864523-e3d0-4e83-a725-786c3b1c23ab", "comment": "Malware payload (Dridex)", "value": "828195a944772e99146ba63b09595be00f0b101c8d7d4a3ed6eda911173eff0143c63f600d57fa35310c3df8918c7fab", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839693, "uuid": "bb7eb9e1-dd67-48c0-87d7-336ad959b4c3", "value": "86F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839693, "uuid": "f5d67eb1-7b02-40ae-b599-25e336551668", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839693, "uuid": "3484cf99-14cb-4607-974d-84cefd900b88", "value": "3072:CmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:TLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839693, "uuid": "439e830c-3d91-4def-b04c-310845c61618", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839693, "uuid": "54bdbeb8-e4f3-4f2b-ac10-d4671103f85d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839693, "uuid": "656a1813-55ac-4959-9f65-83e142e96086", "value": "5bf1ecbe_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21af4c1a-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621872875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872875, "uuid": "49c66675-c572-4d57-83c1-b400f11d6389", "comment": "Malware payload (Formbook)", "value": "b85c99493bd246a58d48e90c248e12b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872875, "uuid": "e39a3ee5-7bb7-4223-9b38-501053e578ae", "comment": "Malware payload (Formbook)", "value": "b2c2371d92995eb349a4d6be53af3c42798af56b94f59adf1d765d2905fd5871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872875, "uuid": "d83daa2e-a3ab-4c15-9011-e06005a47980", "comment": "Malware payload (Formbook)", "value": "189d6e59e5e99f9e7011c45799233d39b1c0df18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872875, "uuid": "cc5d9959-588d-4517-84de-7be7656a78ee", "comment": "Malware payload (Formbook)", "value": "c73a8036255cbad705d4aa7346116a2f402e749b059f15e74a012732064e66c3faec040f173cebf34eec087a912c52f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872875, "uuid": "d37ab221-b59c-4bc7-b2b2-797a8e880368", "value": "2324124B3AC350E3E5A266313AB3D756A3B9BB0057407507FB684FB62A210C7D60BB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872875, "uuid": "dd000118-8307-44ca-b542-e5c25ed965bd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872875, "uuid": "f0884316-ed18-4108-a8b6-40e77a40ad66", "value": "6144:8sBlkGJXLnxpTK9iUnTGWZ7SXA/NWUYHUQ:FlDJXLPTK9i0++LYHUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872875, "uuid": "bbf217e4-1ba4-4e7c-abd7-c00cec36babe", "value": 216518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872875, "uuid": "c9480003-452e-4713-affc-c5abca85ec2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872875, "uuid": "dce91332-4f6c-452e-b02c-fdfc45704b4d", "value": "Sleemacotrading 846483648370058 \u0648\u0635\u0641 \u0639\u0631\u0636 \u0627\u0644\u0645\u0646\u062a\u062c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3b32ac-bc63-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621842048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842048, "uuid": "9445d772-ccf3-4b2c-9bf3-a1c85516fe40", "comment": "Malware payload (SnakeKeylogger)", "value": "494fffe830245b36b0117056c24826df", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842048, "uuid": "8da63b9f-0b88-4831-ae7f-0154cc2f2dac", "comment": "Malware payload (SnakeKeylogger)", "value": "b311289e4fbae837304440be26689a9d3165f0f2798ba0d3e4fd2e42d57368b1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842048, "uuid": "4e4293f4-0339-46e2-a20c-e8bf56ed49a2", "comment": "Malware payload (SnakeKeylogger)", "value": "cc2d5f7db0c46d61cafbeebdf061dbc84e0dea67", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621842048, "uuid": "edc18129-0f80-4b65-891d-566f58fe4aa3", "comment": "Malware payload (SnakeKeylogger)", "value": "4201caeba848eed526f20dc75743fbee4db3da92e27044d935b86145c3331bcaa200d138d69105a9e8a5eedacaa58c61", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842048, "uuid": "13fb6a16-59f1-4f4b-8841-aa3c3e0a6f74", "value": "A246FEF25004B673751A335C79DEAED8EB1250DAB2E6E3909C5FA398DC06D1CBFA4052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842048, "uuid": "bf4b077e-874e-45d0-a8df-b3787c553760", "value": "384:p64D5TECOHmOGcSRSAbbBa7zYlF8BsirooNdXbZc+T0yOpho62CGi8GjGQCGWsiU:p6hRlcnbc7J7ZoboLoA+vD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621842048, "uuid": "8844810d-54cf-4169-b277-916d1fcf3062", "value": 5771264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621842048, "uuid": "d0db496c-0935-4fde-b469-1f02c1c55fb7", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621842048, "uuid": "9dd53fb6-177f-478f-acfb-694f9ebeb39e", "value": "PI_Signed.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b20547-bc5d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621839651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839651, "uuid": "2e4ffe06-ef75-4096-806e-118adbca6792", "comment": "Malware payload (Dridex)", "value": "1c0b5f162c805c664f6bb5b675dadaff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839651, "uuid": "5384fae9-72ab-4326-a1b5-2f8b61dc1943", "comment": "Malware payload (Dridex)", "value": "b396d766a24e5d312bf80313e81dde4629ef426c4f34dd441b8d9b6df0c01a6b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839651, "uuid": "b5468744-881a-4868-b6fe-9ec7482bde70", "comment": "Malware payload (Dridex)", "value": "75126fb4fe3185c2be6133caad20ce019e0afc43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621839651, "uuid": "732383c1-a2d3-44e3-b9a4-698f0cf4f643", "comment": "Malware payload (Dridex)", "value": "98c93936c5f0ae8cb7e498c1bd0a68130f42f2898afbea33fbf6cbcbb20af0dd2334d0235076feb9929ed4f094154216", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839651, "uuid": "a02ed482-a593-489f-bace-75da2f00eaa5", "value": "1BF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839651, "uuid": "1c94ce69-3ac3-458f-a509-e769e4b4bd5f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839651, "uuid": "5b5330f3-330d-4d0c-acf4-571f56303abe", "value": "3072:hmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:QLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621839651, "uuid": "eccc7fbd-b817-40bb-9cc0-748799d6714f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621839651, "uuid": "aec2ee76-2d92-4671-b9cb-33ef3bca65dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621839651, "uuid": "cf9c2a12-44dd-424c-9a16-7e45164e6526", "value": "1c0b5f16_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7389be8-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864939, "uuid": "a89166ef-2454-4baf-86fb-6233e54d376c", "comment": "Malware payload (Dridex)", "value": "2b4ed135d7a9f971feab3c3675077683", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864939, "uuid": "0d3e52f2-edfa-413f-b269-843637e586c9", "comment": "Malware payload (Dridex)", "value": "b3a964c922f724857d0caebd55f38218895dbfcdf7f2d79d86dde3aaa241a493", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864939, "uuid": "f0268d1f-0ba6-40d7-a2ec-c731ce07a0d4", "comment": "Malware payload (Dridex)", "value": "06dd51ed4c99dbca30418d9aeff1c957008f6bfb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864939, "uuid": "c389265a-5992-4fd4-b38f-da604a6629f7", "comment": "Malware payload (Dridex)", "value": "6af62ff57340d84aa13c120e5b4033126723b982be33af20383e7985837d505c2fd0368910f63f8fb23487c7f50b65bd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864939, "uuid": "8b2017dc-8cfb-49aa-922e-24bf71f139c3", "value": "52F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864939, "uuid": "53d14d92-2d0d-4da3-aab7-c3ac6f84a1f6", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864939, "uuid": "755814f9-a1db-4f59-8713-827d00ef8bfb", "value": "3072:lmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:kLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864939, "uuid": "5ad34a46-f1b9-41b7-b0cd-515949c31d3d", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864939, "uuid": "690419e8-0649-43d6-a948-60b76aa63771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864939, "uuid": "b56191de-cb2e-4514-a28a-718ddf6ea3a0", "value": "2b4ed135_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f46786-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890146, "uuid": "90c5bc78-4417-4bcf-9d37-89cb863cac17", "comment": "Malware payload", "value": "75234ce4c0d9a7f24803cf6d95667a5b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890146, "uuid": "25b557ca-90cc-405d-9b19-053b30ff4de8", "comment": "Malware payload", "value": "b46270aac6bb6e8c2247d35a7c7b51b8818548d52a484fa9af8bf90e1ae8b086", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890146, "uuid": "552d85e2-1cfd-42b4-b00f-c79eb9d97a91", "comment": "Malware payload", "value": "4fcc906d75d64cc1a6fce19f7f29bbf674fcc3ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890146, "uuid": "1476008e-56a8-4407-adbf-85849e6e3279", "comment": "Malware payload", "value": "c50eb76879b73a8f4d1e43605500dfc4bee1f4eea28eda9699ab09619a98c1f0d6b4576dc0661fa9ef4907f520e85c8f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890146, "uuid": "8beb2c9c-96de-4a00-b8cd-86bffe050855", "value": "70F3C088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890146, "uuid": "dae7b5c1-a8bb-447e-b9d9-2da010049458", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890146, "uuid": "a9c8ec11-066c-4297-9691-114d3d71ae28", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890146, "uuid": "e320ba83-b8b1-49f5-9fd8-a5bb772a2c34", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890146, "uuid": "5c420e70-42c9-4048-85af-335b13b1c74d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890146, "uuid": "fa1cf384-b514-4081-b7dd-4ba58ad4b2de", "value": "75234ce4_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ba4e5f-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864933, "uuid": "2e95986d-28c0-4d5f-ade1-3a4eac6bf600", "comment": "Malware payload (Dridex)", "value": "2a50c9b87fb639029213a2e258fcd640", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864933, "uuid": "25e9096d-287e-44d1-a0cb-1ffbc7c7b439", "comment": "Malware payload (Dridex)", "value": "b4a3d80ee28ed107b87fa0eb6fbf6be98da001e9929fdf56ba2199f551b65884", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864933, "uuid": "07bf5315-696d-453a-80bf-3aa453428216", "comment": "Malware payload (Dridex)", "value": "0f92c45a6c897ad4385d459ed8559992d4baa8f0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864933, "uuid": "3a88b29c-4549-4f4d-82d7-fd42539084ce", "comment": "Malware payload (Dridex)", "value": "7216b6c8e896f64b9f317fbcf99f90995418dbfb4633a4d4670a9551546f519da05da1a7ddfb8f3f362fa6c50bebccd1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864933, "uuid": "f850f472-810b-4d5d-9581-096ef5c0a62a", "value": "95F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864933, "uuid": "68d61739-1d7a-4ee7-bcf2-af3fd9b37d83", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864933, "uuid": "7ef6b41b-6b4c-4cc1-b315-230c3d59e8f9", "value": "3072:mA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:m3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864933, "uuid": "5acdf61e-2b32-488a-a10e-bf17431c132d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864933, "uuid": "3b37f337-0a8d-49e7-8e02-dadd654e1c10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864933, "uuid": "5093a04e-e0e5-4f28-a4bc-a58150026401", "value": "2a50c9b8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7528ebbc-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864855, "uuid": "5e996e1a-cc25-46a2-a66f-960e5423f580", "comment": "Malware payload (Dridex)", "value": "3fc5abe395d203ae854e1036bfc5f3ea", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864855, "uuid": "b7ec3f49-d14f-4b27-9949-c61d0b04bd21", "comment": "Malware payload (Dridex)", "value": "b5739ebd382c4345f2ef932ddaa3b15068d7523529cb567621444e0ec5eccfc4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864855, "uuid": "d091c20b-06ca-4b72-8d3b-b7c896962bcb", "comment": "Malware payload (Dridex)", "value": "e18a8aa5c28a1df07c4f85786ba816c3c31209af", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864855, "uuid": "97f27611-7f7b-4b85-a6fa-db899316f0de", "comment": "Malware payload (Dridex)", "value": "1b5223e520cf99127e045c889daf5d5617ec19133d90f65aba26416c7a6c100c1ff6a35333ecdbeab5cc8eb609b15b79", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864855, "uuid": "db1a7cbf-fa89-415c-bf49-c3ea998e527f", "value": "24F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864855, "uuid": "85cb64a5-c269-45c0-97b8-3ed5ec631822", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864855, "uuid": "7f615f91-dbb2-4319-9127-f2871843cd9f", "value": "3072:FiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:ueAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864855, "uuid": "99d5bab0-fe2c-45a3-b108-793d1d175fa2", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864855, "uuid": "47e3ca7c-7346-4088-acca-45d60010b924", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864855, "uuid": "0fccf993-2138-44fe-bac0-7b890c3bdb2c", "value": "3fc5abe3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20cb736-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872339, "uuid": "6049671a-5af2-43cb-8eaa-6eaedbc7e3d3", "comment": "Malware payload (Dridex)", "value": "9cefbd05322086760c871a2613a45a66", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872339, "uuid": "754cce47-61f8-481e-85a4-3166e0d18f5a", "comment": "Malware payload (Dridex)", "value": "b5a29fc098064425a0a11b5bb412294f620fe427f6cb6cf413dcbbc8faf3ae2d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872339, "uuid": "ee40bbf6-8b6f-49d4-8053-702daa0a08f1", "comment": "Malware payload (Dridex)", "value": "f606695103739e77e5e72232ebc14876ae2c2f9e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872339, "uuid": "7f3f6c66-6203-4d8b-a949-5aa1d8dabf29", "comment": "Malware payload (Dridex)", "value": "b21a599ee227708ec0770093091f7054d66f5e265e8e7b548255bb66719ee4c5ab8ad9550d1c99a7a2b575eacd2456d5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872339, "uuid": "dcfc2733-cd55-4a13-95cc-15ca7c24378e", "value": "A4F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872339, "uuid": "c76b899d-39fa-4423-83fc-2b2f4d151ba8", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872339, "uuid": "b9df6e7b-5ec6-4716-bbac-06c2a386360e", "value": "3072:4iFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:DeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872339, "uuid": "31905369-1dd5-4b17-8432-93bf7ad51d42", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872339, "uuid": "16457b6c-d809-422f-8a51-684dfe89c5d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872339, "uuid": "b8df6185-3188-4000-a25c-a948ebc932c1", "value": "9cefbd05_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4624b820-bc94-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1621863058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863058, "uuid": "ef6d3813-7122-466f-a84c-4e76cf2995d0", "comment": "Malware payload (njrat)", "value": "f51f4822491ef9a5c2219290b6e42c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863058, "uuid": "e1296e37-6ff9-40b9-91c2-418470b482bb", "comment": "Malware payload (njrat)", "value": "b5d0e34e5891846445d2fe0e295b052303cebad0266d4c64982ff7c49b17ee12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863058, "uuid": "361ae25f-ba47-4a07-b84a-e72f97515e39", "comment": "Malware payload (njrat)", "value": "efe0fd4fdae8d14922140545d4922fcef967e21b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621863058, "uuid": "a7e6ae40-0990-4102-8d7b-0f99e5205c5a", "comment": "Malware payload (njrat)", "value": "6cf6f4b2319724cbecec3c6fc9239e94619aa51e2eab53737e84a424da9b4faf12bf9f80ffbcd783a5a8e36f4d4a30db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863058, "uuid": "f11f1b1d-2075-458e-9932-008fa0c9ed48", "value": "D113D74DB694E174D5FF8BF1B4A2B2890B71901BAD02930F99F114D94BB3EC0A611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863058, "uuid": "3904f218-176f-48f2-a415-be9434bd932d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863058, "uuid": "cfe37736-6484-48cb-902e-3eff197ea7dd", "value": "384:FZyty/edsbhKIyKV1PcSUEgrrMz8Iij+ZsNO3PlpJKkkjh/TzF7pWnh9greT0pqP:Puy2iwFKLPHMuuXQ/oIF+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621863058, "uuid": "9e5c0665-c850-4183-aa38-3553ef7a4e8e", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621863058, "uuid": "cb702f0b-d46d-45d6-9516-bb1457916ca8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621863058, "uuid": "d9415f28-e285-483b-8313-76633fe447ef", "value": "f51f4822491ef9a5c2219290b6e42c3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0265d8-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621838216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838216, "uuid": "4d39315c-c017-4ce2-bef6-1724f917f355", "comment": "Malware payload (RaccoonStealer)", "value": "e0c915696cc6024fc1dcad04c1d85327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838216, "uuid": "b7dcd651-7a08-46b6-89b4-18f259175646", "comment": "Malware payload (RaccoonStealer)", "value": "b623ab0194754c30697c1fde15abcf284e2f3f39e75de7875739055d5022423b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838216, "uuid": "6c011dd8-589a-4fde-8701-1a00ee998a65", "comment": "Malware payload (RaccoonStealer)", "value": "f351aed591212c7594d89cd5c08c6e4fc3336832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838216, "uuid": "c70ccb03-c783-49d3-bfb7-f88cd92b890a", "comment": "Malware payload (RaccoonStealer)", "value": "fd5fd3c213f3d1414e7f3a98d2225312514270cd90cfdd91fb451141a5c1ab1f02f4f5a5092636d5ba70aa714e001100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838216, "uuid": "48e12437-16cb-459e-8ccf-fe746ef4fd51", "value": "1DC4E100B7A0C035F1FB76F459398669A53A78E0AB2450EB22F53BE945785F0AC3176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838216, "uuid": "75e7b66d-f8e3-4363-8811-098e6108b462", "value": "c1547c738f79c15afc554fcab1eba054", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838216, "uuid": "866483b7-fc8e-47c5-8ad2-20d11c54aeb8", "value": "12288:hZveIyDFQ2y/gj6PEjfHtctCpgeyj0hUyVLemQXp6Nqd:fe+2PCEjibJ0Yp6NE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838216, "uuid": "4f0e1e63-1a9c-42d4-8283-c54b1551864c", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838216, "uuid": "5aa257ba-1b87-4108-95ac-869d6f7dbeb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838216, "uuid": "160c5c58-2fc2-49c4-a035-bcebd2e18869", "value": "e0c915696cc6024fc1dcad04c1d85327.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67de6bd-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "b4708529-82d7-47ab-87a1-5b861ab22826", "comment": "Malware payload (AgentTesla)", "value": "3239f13e4c32a28b4894acfb5a26863a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "c883f6d8-a5f0-4f1f-9345-408192e18e82", "comment": "Malware payload (AgentTesla)", "value": "b69b5ba40c54631b0c63ad14f201f9fc3227a57a1edfc4b8d06abce886ac22c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "d8801d40-c03f-4678-ba45-8f7e985a6330", "comment": "Malware payload (AgentTesla)", "value": "fbe9135fdee30b6ce2bb4d94a0e8cad70baa7a22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850469, "uuid": "a6d2d242-05c2-41be-8cd8-b6876f7eb9be", "comment": "Malware payload (AgentTesla)", "value": "1e10d3a1a377a22a2dd1f1dbd29b470c706bce0a21600c73218a0e6daf611c67b1ff90bccb886fb4509eb0829381673c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "e21347ea-cfb1-4c42-a58f-b3c5c8db09df", "value": "BEB423564BD2B70366434EEE01C2EA2C6DD1163FC8FAC6389715E91298D78D4D622F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "12636f16-8b97-4c43-9ba4-43151a9c875f", "value": "12288:m0lRC5xq0GuiLxXimvmZVWC78Wtie8mplY+uSGdZzKxc0:m0DTruWxXCnJ78WUe8M58TzKxc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850469, "uuid": "eec0c568-a189-48c5-81d7-cbab9cb5d882", "value": 494990, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850469, "uuid": "808c1a39-93fb-4ddb-b674-861a4316801b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850469, "uuid": "116989e6-a963-40e6-984e-966ab6c0aa39", "value": "SWIFT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f099ce3b-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875799, "uuid": "db42f238-2b3e-430b-b18d-afc8675b6f74", "comment": "Malware payload (Dridex)", "value": "6b8e72c1513b9e5f77fcf7d27079894c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875799, "uuid": "9c4581cd-fa00-4d38-9ffe-205b9d85db3d", "comment": "Malware payload (Dridex)", "value": "b6b4ae44d8a37b876ef7558070c290dd267f4e2a0a294314aafb4d010cbef5d4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875799, "uuid": "0dcccbd0-e4c7-48c3-89ed-dd7cef314603", "comment": "Malware payload (Dridex)", "value": "d3a1ed8ac1139d6bdcb2a25a500ab084826b9d57", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875799, "uuid": "40faace3-4c79-4500-99f2-3df8b48f3e6c", "comment": "Malware payload (Dridex)", "value": "5b90bcea5bf15e5d094c4af44542d884b9db4efdc5719cb8bcb1e9c424effaecf64a8193a07fbf47906045a9edadce40", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875799, "uuid": "2120dcd4-6ca8-43cc-8d92-335e838c032c", "value": "9CF3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8B496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875799, "uuid": "cc30fc0b-7e92-4a48-b60c-9d63b20d01f4", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875799, "uuid": "fdbb7420-6f66-4e26-8b01-40bff9d79040", "value": "3072:4A6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:43J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875799, "uuid": "4e7f1669-36b0-4ecb-a5f5-a811aea30b0f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875799, "uuid": "fcf747c4-56d0-44ac-8f1a-177014ad9227", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875799, "uuid": "2900c870-161c-4f62-8f00-104c4c8f6801", "value": "6b8e72c1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb2864c-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621871147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871147, "uuid": "d227984a-1958-47a7-9e6b-ea81ec6b33c7", "comment": "Malware payload", "value": "6f7515173c1eaf08a5d76a0a80674b2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871147, "uuid": "65fe5bd3-5430-4fc3-8676-ebcd5c1eb574", "comment": "Malware payload", "value": "b6e0abb2b9a932dcb543fbdb46900a12bbb9698b6d347753accdfe3f4f33497c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871147, "uuid": "9df1ad6c-e16c-4da4-ad33-0e2e23009b50", "comment": "Malware payload", "value": "19e8731a0bdddf3cda5e15bf25f2c4973f05ea35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871147, "uuid": "d3ccd90b-c3a1-40cf-bc1d-4e137469c71e", "comment": "Malware payload", "value": "9514f61a38f60a61df9f3828ea95b2dcc9034c7a5dfac6643a90843d352f35388b067c7cf0f778e9e1c0e6475614404f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871147, "uuid": "b1802768-0367-4e3f-b426-0083a43860cf", "value": "6525E59C326071EEC467CD768AA81CA4EA20347B5B1FC207901715EE9A1DB97DF246F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871147, "uuid": "5ee5f794-fcf7-4246-b308-b17c86df8e9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871147, "uuid": "9b75e402-7336-4d14-bd2c-6753f3710c09", "value": "24576:kYDmZ7Hjqqygi8YKecF5MW1C7gzsrhlA:HmZ7Dqqc8vnDMW1J0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871147, "uuid": "1a7cc519-d76e-4c32-bbe7-2f64e57b40c1", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871147, "uuid": "f70066c9-a8de-4607-8200-3ae2e87cd0c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871147, "uuid": "aaee8cf8-965c-49d4-9487-2b306fa7f48d", "value": "swiftcopy001pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bdaa06-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886656, "uuid": "be489f57-0395-4c66-afd1-78c89eb830c3", "comment": "Malware payload (Dridex)", "value": "021deae865ca32ef93524d382814baa0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886656, "uuid": "c3328569-f8a1-4824-a240-395e06c2e76d", "comment": "Malware payload (Dridex)", "value": "b763d8e657902eb0dfee4531e7a5668a17e753e006cf6bc62ce5d91d00f5133c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886656, "uuid": "812949e3-d988-49ba-b665-3a6ad4e059c4", "comment": "Malware payload (Dridex)", "value": "a17c272ce0b64c2ff623b02a1a16f3bade0702fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886656, "uuid": "8781f9f9-d899-40f0-bef6-0aac8fbd88c1", "comment": "Malware payload (Dridex)", "value": "aec21b6d43b9f63b55cdbdbf039116480280465490198bd69ba537225555dfd758a43e3b2e74f48dec961f4e3a2fdcd9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886656, "uuid": "9e266504-6451-448b-9d74-c1fcf91284a8", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886656, "uuid": "800034c0-56be-4fff-92b9-6ce350ecad84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886656, "uuid": "84cd9602-e2c3-4e9c-a761-0b2115ec9fe6", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886656, "uuid": "e88cbd3f-cf66-4daf-93d3-ed43257c9353", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886656, "uuid": "1336a196-765e-405e-9992-83da9cfab71d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886656, "uuid": "373b9b65-077d-4355-970e-1038a5201b8d", "value": "021deae8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a12d7f-bc9f-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1621867694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867694, "uuid": "fa366855-8327-4790-a110-78dc8a469412", "comment": "Malware payload (QuasarRAT)", "value": "0fb8d607b141430fa2b50aac38bbf0d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867694, "uuid": "93788b34-4d44-4c46-9194-cdaec5ae2bc8", "comment": "Malware payload (QuasarRAT)", "value": "b79d80858c2b5ae1459ab23c24b36cba394213fdf503c8fb1f7cd06b000b40c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867694, "uuid": "39903fc7-78f9-4b36-a57b-2fd5e7363bdb", "comment": "Malware payload (QuasarRAT)", "value": "c6382489218cbf5b0583e64d778dd91d4b294974", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621867694, "uuid": "1ee76693-2000-4ec1-833a-becc56a7e18c", "comment": "Malware payload (QuasarRAT)", "value": "3f6b7a83fedf6e06de08867a06f11832a8360cabee7d0fa5d23e518187e5da7d78a8b9b87eb297001fa8f8b73c947d80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867694, "uuid": "c1acb5b6-3dc6-456f-b0d5-3e33d402686d", "value": "5EA4CFD2F11045E9FC6B1632642B4DA259631CBEE6B9D11C71FA37232BF71A3001A99F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867694, "uuid": "85814e25-58c4-401b-ac40-7d79ae8ec070", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867694, "uuid": "abd49fc8-2467-46ce-bc41-ae82a17661d0", "value": "6144:sscWVqB0pLln0U3GV0aMPA7xwBqh1sqID9GrBdXERW0:NW0pBn3ZstraWzXYW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621867694, "uuid": "44eee228-5121-4ab7-9b37-446f7118f402", "value": 458050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621867694, "uuid": "f714ca4f-1d70-4af3-bd0b-9f2b477b1d41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621867694, "uuid": "eaa2646f-5cb8-4055-a274-3fde80ab3292", "value": "4090800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49aad99e-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879385, "uuid": "4fab292c-95d1-464a-a214-a3a6e84575b6", "comment": "Malware payload (Dridex)", "value": "c03542904232cba87f9f8974c0adeb60", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879385, "uuid": "763b7656-3eb3-47ce-8736-04838a218ad1", "comment": "Malware payload (Dridex)", "value": "b7c1dd829ed34521547e0d18817bdac4f82b188ee58f8c1c165a93a2a48e4a19", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879385, "uuid": "573101ba-04c1-42ff-a55f-a28772f648ca", "comment": "Malware payload (Dridex)", "value": "9dbaaf701ecde1f34426ba546b078f3c98cbe9d9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879385, "uuid": "de4e70d6-f9d0-42d7-a04b-55b52456ad9f", "comment": "Malware payload (Dridex)", "value": "6f22b31c0a790945bab242b7469e66ed03b09c1204c43376e2ed18dfd15d98f8e3361060a15f2ee871794a60433fd936", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879385, "uuid": "c66a1734-c82d-43e9-831b-feb6ffc2296b", "value": "82F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879385, "uuid": "a35ed8de-a8cb-4fe0-9032-d2e00846dfc3", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879385, "uuid": "3e205b87-aae7-4f49-bfb4-64ab2b8d1a72", "value": "3072:LiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:oeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879385, "uuid": "2360658d-1eb2-480b-b933-62692b5d2f91", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879385, "uuid": "eb939b4b-e9ca-405e-ad69-b46e1d8c8777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879385, "uuid": "e72686f1-bb56-4db9-8c2c-5a844900868f", "value": "c0354290_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21a68bb-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621836181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836181, "uuid": "01eddbe8-210f-4527-9a9d-07058b616bf8", "comment": "Malware payload (AgentTesla)", "value": "fb27a7cf9613996237f2320786892994", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836181, "uuid": "605132f1-2d98-43df-b8cf-355431e82544", "comment": "Malware payload (AgentTesla)", "value": "b7e9d7526a6dfddb1ae7247f9c17dcc12627d0b6a44b05e9053ec603b98181c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836181, "uuid": "854bcfec-c35e-4e87-912f-340e8d59e19d", "comment": "Malware payload (AgentTesla)", "value": "88d3980d11eb93b0f05c0b34cd1972760403c5c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836181, "uuid": "5317a876-2c05-46c0-9535-f5c71b005a66", "comment": "Malware payload (AgentTesla)", "value": "6dee57ac04f47475a7e7e19c3e4264408e422b07efc8f3aa47c2fb14d69fd8b40276737fe2a274cc001d1479f2a1671c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836181, "uuid": "5bb39072-efe7-4661-85cb-a3b13eb0b097", "value": "5FC4232D3603E58ACD8CC652C0436DD464126C90BE27DBE5D1AE866CC7960EFEB41EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836181, "uuid": "77dc30b7-3eeb-4c9a-bef7-cd39dc2f6820", "value": "12288:/ioBpBVoLY2gCJFsBl6Gn4OlINQ4a8uHQcCNR4eoLu5lbP71CBcJ3ooBUGB:/JBpPob/DG4JNQ4aNFCsK5VYGJ3ooBU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836181, "uuid": "945c9923-0ebf-49c4-98d2-e8ded0f8004a", "value": 580761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836181, "uuid": "0873f6b4-55ba-4cc6-bfa7-1ad69ae707ba", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836181, "uuid": "b08c3de4-3008-4543-9693-eb12bc1bee1d", "value": "SKMBT_C36017022617081.pdf (30K).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa260c9-bc80-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621854779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854779, "uuid": "fd91dffc-9efe-4498-8a07-020f53101095", "comment": "Malware payload (Formbook)", "value": "f147242203f1471d0f7265faad01fba6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854779, "uuid": "b4232090-46e6-41d2-852c-856a79a1f574", "comment": "Malware payload (Formbook)", "value": "b804e7c3a6a9244d379f981ad8eef4a5ebcf2f36b91a44a6ce190e08a0c34fb5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854779, "uuid": "c6d44003-f6bc-4f9b-8af8-bc596b912d0e", "comment": "Malware payload (Formbook)", "value": "8cc6b62abef52c1b6a921b7c4a25418051bb69f9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854779, "uuid": "ad824d09-c86e-4ce3-a8b5-432b49ad9c72", "comment": "Malware payload (Formbook)", "value": "ede7456235cb87247e23c9f32b16540f6edf062ddbb166a01cff249bea0e55a88b3ac5d9d9f0ec5e53c8f9edea5e0fdc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854779, "uuid": "a917d058-16f6-43b7-9c11-5abbe04b6bd2", "value": "6B242350E291507B01345E877A8369D47944BBB263532E2CAFBDC3C6B1439D7C9F80AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854779, "uuid": "0aa0b061-b308-4460-9c4f-c3da1eabd0b7", "value": "6144:R9Gb4NV9OZYAnBlaj96H13Rp/cv/9QX0UQvEO/yKN6W:7GbUOZYAfak3RWHw0Uu/bNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854779, "uuid": "8b880326-82a7-4f1b-9b75-0a99dad24ade", "value": 224997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854779, "uuid": "4192639a-8c03-4c63-b874-5191e3c94311", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854779, "uuid": "1fea09ac-8278-4848-a96f-eb9953575d22", "value": "INVOICE-1322.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a144bdf-bcd3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621890123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890123, "uuid": "2d74e7dc-daf3-4911-bdec-ef8a9649799c", "comment": "Malware payload", "value": "4b5b7cf394b8e0c972e123662ac1ba70", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890123, "uuid": "f26366d6-69d4-4027-be6d-e443575521a9", "comment": "Malware payload", "value": "b8126d806cf4ae9a5cc5b4444f99760bdbb2b459059f92b67eb166754fd33269", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890123, "uuid": "1f62e903-29b0-4f75-b4b9-12450569c998", "comment": "Malware payload", "value": "efe97ade25ad30f76832c9a7ea0786e126b3fd5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621890123, "uuid": "b6afb7a3-ad33-4fb4-a56b-4ae48350389e", "comment": "Malware payload", "value": "7a6e6ca0eacd3701de5860e2d4c7873670d1ea859a83ff2176e002bca41947e9c6d4bedef63f4affb0530ee2bcef1937", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890123, "uuid": "2a1fc79f-8654-4d5a-b5ab-56be18bf4c04", "value": "A5E4631DE20BA156D3214B77FE158385817BBDA2491DBA4A375DBA2ECBF01D0E72C318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890123, "uuid": "07bcf420-f10f-4c55-8409-43a701c5fbb3", "value": "6144:g6tIrWqrY5O3NMHGRYc9u/YRTP85XbKKlia+eTsnt2uCMpUMR:CKliIT25PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621890123, "uuid": "d363380a-706f-4e38-a629-fe81a83d1cf8", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621890123, "uuid": "6d9dddff-1ca7-463e-b079-ad1db20f55fd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621890123, "uuid": "fa2a3ae1-9d75-4a03-aaf8-a9180e81cfdf", "value": "4b5b7cf3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ac83fe-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857693, "uuid": "527fced5-454b-4e5c-b0cc-c70daec271ce", "comment": "Malware payload (Dridex)", "value": "568b15ee020afe638db327c371b40130", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857693, "uuid": "9fc5ca26-0128-4ff2-aac4-84799833a0ae", "comment": "Malware payload (Dridex)", "value": "b83bec6f7b14516de858581eb0d3e2feecf7d7f0b7c7cf32bdf86fb7d9271abb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857693, "uuid": "d315ef76-0393-4c66-88c3-edf06883e2d5", "comment": "Malware payload (Dridex)", "value": "884bfd78587b9f743459c54826df832ced4f7ce2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857693, "uuid": "5b7ae403-711d-4ff9-9a6a-8ad72337a0bb", "comment": "Malware payload (Dridex)", "value": "e7b82cd1b7e58a0c040a9a0a3f687dff9bb97965d01c092465a8c8fefc32e99b4a43d140ed4ccd6c70448deaeeae19bb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857693, "uuid": "0436d8f5-6657-4aac-a5c7-2de88cfb2be5", "value": "39F3DF08D1CFDA46E00B69700D9A761BB79839812F7C8EA8A496B1FD4F43725E490B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857693, "uuid": "a13de3a8-ae9c-448a-b8af-8be7c833a46e", "value": "835c0fbcc6459f6264f92edd519c6e5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857693, "uuid": "093f8350-acc6-4014-9d84-f6def690a2b8", "value": "3072:KA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:K3J256FBMO93IuAiywi4Y2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857693, "uuid": "05fe5cc3-03b6-4666-b7e6-481dcaf70a59", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857693, "uuid": "27c08e07-1abe-4cf0-9f08-190e83453f45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857693, "uuid": "006478e9-8f84-4905-b6a8-10751908730c", "value": "568b15ee_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6769724-bc6c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621846066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846066, "uuid": "ea01517e-3c3f-47c1-a4af-a4c660822575", "comment": "Malware payload", "value": "42eca621c14118bca52475f8fd3c9af5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846066, "uuid": "d26ebbdd-1047-4684-87d7-1a35adbc3d97", "comment": "Malware payload", "value": "b88f652dd6454bd563a0da3347fd01fd61038156643c9c8b98ba505431a4ebd4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846066, "uuid": "27fbaae4-5e92-42f8-bee8-91c64d764362", "comment": "Malware payload", "value": "6dcc431697d565f5bd13041e230e720482047ba1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846066, "uuid": "2eebc3b6-cb6e-4613-ab11-a3ed776715a3", "comment": "Malware payload", "value": "d3eeabffd632528a3e0a16f6e335a60fc0df8aec2e9aa1c610059215c6e879d51778edf5e4d74ecc1ba8a7e25d4d890d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846066, "uuid": "ad4927df-1ab7-44ef-9802-156311e056b6", "value": "A044274A7196CD2FCF9800784C9ACFF9AA92AC85EE4461873645FB1E3CFE554D7A2301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846066, "uuid": "8cd53866-0f8d-4fd2-81c3-e8fa667b909f", "value": "3072:Dbm2uj8+DF5oWvTNTpLzCGOIRcRYuPwUhTmcZTnGVaxlgl42Z6Oc7y3EWuP:O2u4+DbBry/ImrH1mcNnG0lhY6O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846066, "uuid": "a23a5f7c-a4fb-471a-9d56-99c8562297a5", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846066, "uuid": "d097612c-9bc9-4ca8-876a-f0af80ad0ed6", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846066, "uuid": "96c1f84f-ea85-4426-9477-1dd683b8fae4", "value": "vbaProject.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc30a97-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857647, "uuid": "a0b40c3e-6796-4e6d-8254-d3b9434c5344", "comment": "Malware payload (Dridex)", "value": "ab85fdbd8d11e83366f38b19db38718e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857647, "uuid": "cceb6f29-a736-4ca7-9cd9-4da144091029", "comment": "Malware payload (Dridex)", "value": "b92e2537e6778dd96e97852428f5e1232a1e45e982d5e2c5eae24a20b763fc8d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857647, "uuid": "2ce68170-5b63-43ea-9ef1-50f1e60e997a", "comment": "Malware payload (Dridex)", "value": "016484490fdd1ecc39ee312f8a9a6204f5401fc8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857647, "uuid": "09490138-6c59-4c2b-8681-98968e16eade", "comment": "Malware payload (Dridex)", "value": "bdbbf8960ee3a5fd21ec685ec9f19f64e3b2e18fd8f211843e7d3678bd1dcaba525df52aa8b520ba9c1842f0b5ee4992", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857647, "uuid": "0aff4eb7-7f16-4a5f-9aeb-a50022517cc2", "value": "40F3C088CBB3E4E6EFB2D37976F85E1B461674551408B4F4C86CA58F74ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857647, "uuid": "5a83b4dd-17a7-439c-b498-363531ed97c9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857647, "uuid": "119bce5a-4de4-4780-8035-10c1470d8349", "value": "3072:WIcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:/c7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857647, "uuid": "92fee6bb-06c5-410e-804d-a6dfda90a540", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857647, "uuid": "bc4e1e3c-9597-4be2-98dc-6902671dc1a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857647, "uuid": "cfe2221d-f813-47ab-a189-9e97342017ef", "value": "ab85fdbd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8fc1eb-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872627, "uuid": "393e4bc0-281f-46fa-a5c2-b873b583a004", "comment": "Malware payload (AgentTesla)", "value": "90b344868732f6dd10040d04607a3275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872627, "uuid": "db457011-55c3-4651-8b3b-e5cf93f51a28", "comment": "Malware payload (AgentTesla)", "value": "b9531099f36baa9a749d695e7a4a4fad9a4048b20100f4ba399d3150ef976161", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872627, "uuid": "bdffa396-765d-41f5-b20d-3e755e30a5e6", "comment": "Malware payload (AgentTesla)", "value": "08871aa077b56c11987f8dcbe441465a5a5da44c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872627, "uuid": "86237e43-63d3-4781-bbd7-43a080e183d3", "comment": "Malware payload (AgentTesla)", "value": "4854c3844aa64a347746bbaf5f4885cf5083ff0c9a6ade0fcaee8efb468a35963b2757230b6c3ed6f1919f661f6c07d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872627, "uuid": "c3c71cd0-6574-4954-8af9-e581a48c0533", "value": "7945162DA202E080F55DD071CAD0BAF6D406EF3BD9262D1795C73F81723AE467A3A15E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872627, "uuid": "b3bc8079-bddd-4c1d-899e-77d198425a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872627, "uuid": "dbbd5f63-167c-451c-80c8-39b9ed4f32bf", "value": "24576:V1BCVsbnzTgZz5+4WM8MV/6Zrpka2aOG:XBCVs7vgN5+Mr56J2at", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872627, "uuid": "7f40521f-7bb1-41a4-83c1-52ebc58ce5ea", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872627, "uuid": "fc900043-5a8a-4ff3-b0df-15e50c52316c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872627, "uuid": "13b7ed16-c4aa-451c-9ab8-91fda1356139", "value": "Doc_Quote 24.05.2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ffccab-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872636, "uuid": "08d7cdf0-e99c-458f-8c1c-941a57ee643e", "comment": "Malware payload (AgentTesla)", "value": "2d79311ed1f0394e55069240a8a3e535", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872636, "uuid": "7ec808c6-9966-434d-adaf-59737053ff8b", "comment": "Malware payload (AgentTesla)", "value": "b954b6fde305e762ae72632348dd14203ef942b2a787cd640188ae304c095748", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872636, "uuid": "b1b664ee-9ba7-4927-b8df-5c4de0e58ecd", "comment": "Malware payload (AgentTesla)", "value": "22f09f26a4848d1510583a6f9dfac38f7176cde9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872636, "uuid": "f6720810-19ee-4264-9bc3-3766d95dad24", "comment": "Malware payload (AgentTesla)", "value": "5b0ceedee6588644dc00cd4ab69aafb85138eabc77255387943efd6955be1acc66310fac1a5dd54fbaac2519cf6e50ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872636, "uuid": "c67050e1-ddbf-44f0-b638-3bc3323fea3f", "value": "2CC427847150B4CEC826CD356A9CCD18E65A3C62B3565F837C8333AF95FF5828F452AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872636, "uuid": "f3f188e6-1a4b-43d9-b1df-eb10192b6dea", "value": "6144:OpU7qfLAkqfT5fmWPu2+S1FKnP89RqwcU4H444h:OpUmA/+7PURqw34H444h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872636, "uuid": "9adf10fe-cfec-4fd4-b23a-eb25ffb91bfb", "value": 582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872636, "uuid": "57b5e133-dcdb-46cb-94d1-4887ba65934e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872636, "uuid": "3aa920db-9538-401c-8f5c-b4ce55a9aa2f", "value": "invoice2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc726a8-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850504, "uuid": "66d2462e-6b86-46d1-b119-3e4e9a04a0ee", "comment": "Malware payload (Dridex)", "value": "f520226d938cf4834e00dfe1c7cb7596", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850504, "uuid": "de737444-2ac4-40be-a9a5-d11747425964", "comment": "Malware payload (Dridex)", "value": "b9c04a705967345470de7081597a14dc5d2a37b058c8f1928009985350f5132a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850504, "uuid": "051f715a-706a-4b92-8d52-98fd85db318c", "comment": "Malware payload (Dridex)", "value": "d87378047ad5ef30b68bf785634e4170fedd663f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850504, "uuid": "e7fdd689-383d-4507-969a-b2534a8eb7f6", "comment": "Malware payload (Dridex)", "value": "8d16e0d2751b04fb6a612820cc2a5056106d9c5a5344a6d959b127152ea83d507c7b66c1132a810629098fa6fe9c0ff1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850504, "uuid": "f37bbd54-942b-4451-bece-20e34f40734e", "value": "F7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850504, "uuid": "8a6b6df9-cb2e-49c3-a0e1-c998ae8effb9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850504, "uuid": "a8a114d6-b34c-4c0b-a3e5-1e1473aa1a06", "value": "3072:nmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:mLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850504, "uuid": "181a0abc-d9ff-4c2a-9139-29264298891e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850504, "uuid": "8330f8f7-fd29-4baf-a09d-aed77ef516e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850504, "uuid": "b0065e20-ac3a-4fd8-870e-0fb49af76eec", "value": "f520226d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7811452-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882978, "uuid": "33cbfbbc-3ef0-41c9-9238-c8c968c10d3e", "comment": "Malware payload (Dridex)", "value": "40c7b8e6b804551c365642d3b56dfa5b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882978, "uuid": "880bbb0b-355d-4b40-968e-1e33d227411b", "comment": "Malware payload (Dridex)", "value": "b9cc1e06f5ff45ad7b15f9d4f5a712d961fb579eee9b0eef710bdc61a240280a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882978, "uuid": "929e6049-8832-468a-8fe2-8baea2b9ab1a", "comment": "Malware payload (Dridex)", "value": "7a5b4f53c79bc05714cb2e2ab5cc40a12a48a114", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882978, "uuid": "60c546ef-2372-4ce6-ae32-4dcb89fd5c47", "comment": "Malware payload (Dridex)", "value": "a35b681ad30481e7debdaa83e9d161159315d21b348ca8e58f8868678c8e1af35900f683b081c2e42b1560d153ea2fe6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882978, "uuid": "358a7f7c-077d-4263-bd2e-68a877be561a", "value": "22F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882978, "uuid": "73250ea2-6dd9-4f08-9818-45f3ad214900", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882978, "uuid": "d5de5015-2532-4dfc-a65c-0c7761473c8f", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882978, "uuid": "c0e81d9a-2794-43d8-ad02-a6487ba218e2", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882978, "uuid": "42f571f9-fa3f-4727-8c6d-5f36e7e9d297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882978, "uuid": "3d895532-ccd4-4553-b10e-8088587ce1e7", "value": "40c7b8e6_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4ee27f-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621854208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854208, "uuid": "072edea4-6954-45a8-936f-8d6cec085add", "comment": "Malware payload", "value": "d836d0744f38061b33d2b63e0431e72c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854208, "uuid": "7909ca47-0800-40ef-aa2e-24fc40614b56", "comment": "Malware payload", "value": "b9e3246001aa002e090fabb7a16f4468d6f841c02179bc7a1135df5ce5294d9a", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854208, "uuid": "6c19ec86-4b00-4b50-b208-e77d04322d93", "comment": "Malware payload", "value": "332e60a95bdf490d77c66a26fff8adcfc2072dc1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854208, "uuid": "99a7f785-167b-42c3-914a-a5ee413ae614", "comment": "Malware payload", "value": "f7a2af72c99c4d40f127229a9524175b7509d014106f800d51dd9c57aa2634e8aedc946430a014dbc44c55b7f0dc31f4", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854208, "uuid": "08a2b9df-1c56-4222-b4ac-3e6bd46902d0", "value": "1F24E120B6B75C15EAFB6731E6B287256732BC019B75C70F1244735A6873880EE13B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854208, "uuid": "4b2f4e56-bfd7-441f-a871-cc7049b3e015", "value": "6144:bV3VopV6vXmuTpJ54cNNQydZJ2RywpZw4r:bV3VbPXNgs7qN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854208, "uuid": "2c722fa0-f39d-45bd-8e86-37943e66bc47", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854208, "uuid": "1604a40c-9f86-4c82-9a68-b869f2b9bb2d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854208, "uuid": "411ae409-362a-4027-9234-3253e756810b", "value": "Specification Sheet of Battery Powered Wifi Camera.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8763e1-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857643, "uuid": "052109bb-8602-4893-8ec4-e4ddb4ff7bdb", "comment": "Malware payload (Dridex)", "value": "79bfba8456b73db5b42126ffc970f8f5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857643, "uuid": "2e47353c-21c4-41b1-b3b1-268155997712", "comment": "Malware payload (Dridex)", "value": "ba00a27991c6b35c0cda544f9d15f18ec6e6fdea4014384190584bccdfdc207c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857643, "uuid": "3fcbafa2-245c-4a81-8bb6-e8c96d268a79", "comment": "Malware payload (Dridex)", "value": "3d68be06b835f44a79dc50239586a66f335cb2da", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857643, "uuid": "caf3fabb-3fe0-4e43-b842-ed3da25efd3d", "comment": "Malware payload (Dridex)", "value": "720aac55e2d4583be2a361d60e7a094917fbe8b3f9bb3fdd124a25fe368c83ef6f845b7cc5234f3511aeac8e57566fa7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857643, "uuid": "221f1e58-66f4-45cc-8bc5-db92591bca7c", "value": "90F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857643, "uuid": "30fec8d4-dd61-4c58-ab7f-79d4ce1a587b", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857643, "uuid": "e1d60fd1-2137-443c-844f-0a0a6917ac2e", "value": "3072:XiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:seAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857643, "uuid": "21a89cab-ad7b-4f0c-9fbd-804cbcf440ce", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857643, "uuid": "f9c1f20a-21f7-4374-868f-4308de411778", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857643, "uuid": "ccb80044-ebba-4f71-87e0-9102500ef20c", "value": "79bfba84_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e304c2e-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621861273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861273, "uuid": "cfb1b33d-13c3-4503-ab03-a324bab7b509", "comment": "Malware payload (AgentTesla)", "value": "cc113e1548a7ca0f14ef53d62ebb0110", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861273, "uuid": "b2aa2c6d-0769-4000-9284-5e08229a30a6", "comment": "Malware payload (AgentTesla)", "value": "ba12542a6600f5dac04210c51f82fe6646a53d16aba540ed422a73002034d412", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861273, "uuid": "4d31c20b-e6f9-4bee-a44f-21072b2770de", "comment": "Malware payload (AgentTesla)", "value": "6b2acc24fefd66c5e60c769b57b87b4ec37d7d99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861273, "uuid": "b2ab24ed-da19-4743-8554-62cd6e4083ce", "comment": "Malware payload (AgentTesla)", "value": "5b62be45c3c3fe3cceaf1e7be39272d04a80a02f3669319540623c94e8c5d6e687fd8b77693cc35755b2df9a2d8547b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861273, "uuid": "a00e1e92-6a4f-487e-a64d-4bd8b3673ca3", "value": "600533262C26D84C4B49ADF8730DE80ECB64947C3EA61BF18DB36F64DE506A8131756F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861273, "uuid": "821e1595-b966-4eaa-9be5-27d652198250", "value": "24576:ucpl/QcD346zCrl/THLhxJGRGz6KMcN+eudDGS+t:uAlNTPzCrl7HLhxYMz6A0LyS+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861273, "uuid": "a3ff1ece-1930-43c3-9412-82be206a1980", "value": 837861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861273, "uuid": "ccc0f67f-e52f-4454-8a69-cc188ba0fda9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861273, "uuid": "2db4da74-092b-42e8-a745-0d156f361e04", "value": "cc113e15_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d36098-bcba-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621879303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879303, "uuid": "cb1f30ea-942d-4cbc-98a3-0029df546ca8", "comment": "Malware payload (Dridex)", "value": "6065188142f7e14ee4a84cb130ab398a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879303, "uuid": "f3957e11-f694-46a1-ad33-a54c3c59cbc0", "comment": "Malware payload (Dridex)", "value": "bb9b9e466bd79ccce5de50acd7532ee1d3ae13f6623ad0381068c83c76ac231a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879303, "uuid": "dcdacdea-dfa3-46e2-8e73-74773e90f8e4", "comment": "Malware payload (Dridex)", "value": "f77a3efe1d493e485dd6b5f0bb4ec79e43d0ce3a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879303, "uuid": "53ba7345-20d8-4c90-bc2d-14a6fb3dd01b", "comment": "Malware payload (Dridex)", "value": "6716c2a907a991a40d7f2eb0933ca7e71f8b9d1fa33973b0d3785fcbdbc1f09d0665aaac02f72f061405066df50c85d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879303, "uuid": "cb6d7252-62a5-4e89-8782-20e03ece789a", "value": "45F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879303, "uuid": "3872cd67-2115-48ab-be73-6d2a9334d377", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879303, "uuid": "f820b733-41a1-4fe1-b4bf-5bd119871445", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879303, "uuid": "c816ea36-ef84-44e7-8d23-e3bf21261983", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879303, "uuid": "c30d9d85-fc18-44b9-81bb-2263ea886d4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879303, "uuid": "5a187da9-253e-4fb5-94c5-85989b11d38a", "value": "60651881_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84125e9a-bc3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621825366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825366, "uuid": "5bff22b6-44dd-4c25-aebd-517bb655606c", "comment": "Malware payload (Dridex)", "value": "f28afcf921132c6ce4518d639bebc219", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825366, "uuid": "9a52f520-ec06-4c8e-8357-3c801c5266cf", "comment": "Malware payload (Dridex)", "value": "bbd1ea3bb6d3f215a0e639c2739e7e01c9f5d4fa1a81904afae16e12f5ff5c33", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825366, "uuid": "28ccd07a-da93-469c-b852-78f9447ac5b0", "comment": "Malware payload (Dridex)", "value": "fdfa836638dd9d46d000bcee8cd85f01fe7bd772", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621825366, "uuid": "fa1e86a7-3491-4955-b3b5-bee8a3b97599", "comment": "Malware payload (Dridex)", "value": "8906a21d6b58ea070b22e3cd12b553b17b4a54eda85f8ce97a0be3ba9a59b30e639b4d61de192c33f6e914e503004540", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825366, "uuid": "195afa78-6541-4550-b7a6-e345897d1add", "value": "17F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825366, "uuid": "77f11f69-b0ba-454c-8db5-fef14ecdbcbc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825366, "uuid": "e990a0d9-34ba-4053-9d1f-94d3a30f4d18", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621825366, "uuid": "018daa37-1430-419f-82f2-b142217ba4d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621825366, "uuid": "50720d88-72f2-4412-a918-ac1c87cb7ebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621825366, "uuid": "79495085-ed4c-46da-b291-abffc01b830b", "value": "f28afcf9_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29c2ef21-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621871171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871171, "uuid": "2f2bbad1-1bda-4969-a8ae-ccb777ea5d8e", "comment": "Malware payload (AgentTesla)", "value": "3ce2aed8a7f7f310f4e372ee0a5e801e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871171, "uuid": "246a7c0b-df1b-4073-a3e4-68a2ae83cab1", "comment": "Malware payload (AgentTesla)", "value": "bc0965261136c9ff0d37c64b5cb3b2ef242580016f826156c0181fdab0b1d4d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871171, "uuid": "e97809b1-d188-4dad-a1fc-3f279eaab703", "comment": "Malware payload (AgentTesla)", "value": "82e9c612f9cee911a423c3cc92215c1a48bd784d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871171, "uuid": "218ad70e-6192-46ed-b249-60c48842b007", "comment": "Malware payload (AgentTesla)", "value": "1aaf98c9d57e5dabaeccd23f3363e08020e7a9ff7acc2de18fa0c1d1218399b5c0678830d470fe5a07041d468e8a07d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871171, "uuid": "23f8f94a-57a2-4bf4-bc79-8f647c6d757f", "value": "4A15AD2C516EF226C2A9C37946D4403BE590D7373132BE29ECD7279D5728E81BD8227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871171, "uuid": "8b7e83ff-b262-4fe7-be01-612578dd3db9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871171, "uuid": "4e147f04-d359-467c-b923-50bd9428dcc3", "value": "24576:qDBC+coOP0BAq43ZdkQM4/REBzvzEYuITqAR:qDBC+9jBdmdkPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871171, "uuid": "5f0c8cbb-f715-424b-8d24-d97721d36999", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871171, "uuid": "8a984100-f57f-4582-a66e-d289665256f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871171, "uuid": "48ead30b-2427-45ba-8c4e-03f8c170a5e1", "value": "ye6syZ4H6Kpq6Z1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77748e6a-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1621836082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836082, "uuid": "b0f6a180-5b2d-40d4-b523-91dc8d704e5a", "comment": "Malware payload (DanaBot)", "value": "bdbb82acdd6ea587bb10ca6b2e41fa6e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836082, "uuid": "a59c3001-9c77-4d47-bb0b-33ca53f7bb74", "comment": "Malware payload (DanaBot)", "value": "bc0ded251a44cc8a1240e278143cd6071904eb1d0fe12d8e6f8d8879f85762f5", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836082, "uuid": "d91d816b-da2c-49f6-96cc-88267359ead5", "comment": "Malware payload (DanaBot)", "value": "e3a3795234acc91a711ecfe5e171777fe9a79458", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836082, "uuid": "b887e0ab-6b73-4fb3-a2b1-347f79a32a4b", "comment": "Malware payload (DanaBot)", "value": "25f85350e680b5fbd1608a7951426b5e18144037096e8ff04126b8e1951139906f38ad571be10aea83399575c8247fe5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836082, "uuid": "277bf996-0845-45b8-b0b4-2099fe06ee33", "value": "0355125239D6C0B8F0E597B04666DA7680E9BD250B2246C36BC13FCF7A3F183D638569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836082, "uuid": "b8a52494-0322-4ca8-bfc0-db74b1a07327", "value": "011a034751880c1944da3b5ecc18520d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836082, "uuid": "3c897aef-170a-4214-a5ee-e316f5d7ec29", "value": "24576:Uzijg9Gy84YxArp4Oc+DDOvQYtIMSqEkEPN63QXszzSqsaiobDXp3:UmMT8B24O7DJbMREF6kszzhsan9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836082, "uuid": "256756b3-61c0-4771-8125-1f0f8f9a5cab", "value": 1393471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836082, "uuid": "fa15eec7-3874-4439-a7bc-a39bcae5aebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836082, "uuid": "774e53ea-1fe9-437b-a8ac-96410f2e13d0", "value": "bdbb82ac_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903d22e6-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872631, "uuid": "78c7a5dc-c0b8-4edb-85e6-0c8daff38825", "comment": "Malware payload (AgentTesla)", "value": "80ce7a7877e0ca94191f1630d09f349f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872631, "uuid": "605e0b61-c68c-4fe6-9e08-48d55d86f2ac", "comment": "Malware payload (AgentTesla)", "value": "bc57e25fd375373c87114d6f5671e1dba1d94721da03fa314d1a668bc93e7d72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872631, "uuid": "07732f4f-c6b1-4eb1-889d-7986297833e5", "comment": "Malware payload (AgentTesla)", "value": "52ee9d5b593e78874f74e23af7a83bba51a81e92", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872631, "uuid": "cc8803e1-5beb-47b4-821d-f20954d7378e", "comment": "Malware payload (AgentTesla)", "value": "ca66fd7fdfc0e271c2d76ff64a3924df7537de2d018a0a4b230d2d73604d924b05c4ec452d0feea335e4d5db6e5f32d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872631, "uuid": "1015e6a0-2639-4f26-9481-56236608f030", "value": "C815E31C9169E122C958C27AC6C4A4FBE560DFB3E039A917A8C77F583635E40F87136E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872631, "uuid": "575345d9-df87-42da-9b38-a4b5ff94ff81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872631, "uuid": "b54f5242-a5fc-4f4f-af06-abd64d89a45e", "value": "12288:pzPXBCfbthHxlN36z9bYTxm8TuZuu056htChbVASGTA6qkWkCSdRaatCA7B:pBCfFli9MXuZuu26htwbSZjVrdAKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872631, "uuid": "32139390-f64d-4c1b-9843-1775543c976b", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872631, "uuid": "3b9c94a0-4e36-47cc-a065-7f35d399fd3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872631, "uuid": "ba9bc794-622d-4d45-b1c5-b6b4b05e2c49", "value": "E-EXPORT CHECK LIST MAY-24-2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7113113e-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1621854110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854110, "uuid": "a43a924a-616d-4cec-8fd1-b9c4454e90ee", "comment": "Malware payload (GuLoader)", "value": "291d7cd8eba319c90945357b1eb2e1e3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854110, "uuid": "1c8883d7-52cd-4934-a32d-66ffe9b87920", "comment": "Malware payload (GuLoader)", "value": "bc6cc813052b757813f53f34ba27b06557484f4601a75275c0ae9ee77e384233", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854110, "uuid": "04466f1f-67f4-410d-994d-754e748ebcbb", "comment": "Malware payload (GuLoader)", "value": "93021b67f5409a2f2abc8a52e2b37aba601f4d91", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854110, "uuid": "fa77cbcb-bfbf-42d6-999f-6daa4e65c18f", "comment": "Malware payload (GuLoader)", "value": "817e652a83720079390207fa8b10cfa7cb08340231211339346e4d5289f21847f41959af373a3afbe5afa93053a7320c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854110, "uuid": "fd143e20-92a7-45cb-85c2-492af816b34f", "value": "834302868D1CF1CCA9E12DBD2729364D65D1A145938BFFEC2F4D045C96A6B027A323E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854110, "uuid": "8a655aa0-c1df-4495-a62a-149217f95f83", "value": "1536:v4YyAkF5C9XXld882IFvg2MIRTpFkZVjGb4uQCXA5S:gTFMTdhUkFkf8Q5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854110, "uuid": "832d41d9-61f8-4e35-b53b-e7a5505830d1", "value": 59169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854110, "uuid": "c864d6a9-119a-4f2f-adbc-93b3ea240615", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854110, "uuid": "efc64633-7a9f-491c-b782-b8ee027b55ee", "value": "291d7cd8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24df973f-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832508, "uuid": "13e6dc8d-11be-4f9d-b6e5-a3878dcd304f", "comment": "Malware payload (Dridex)", "value": "b8e517ce65cc5107fe45aad294f48de6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832508, "uuid": "8acd2df1-558d-479b-b782-278abb8077b1", "comment": "Malware payload (Dridex)", "value": "bc7cf6af7d35bf0e7bf041a00578c45b7c2620f43f1412bf3bae534d5383dfcb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832508, "uuid": "df8d4cc3-646e-4c09-8a94-a3c5e30c1b05", "comment": "Malware payload (Dridex)", "value": "983dc27572c07bc7cf515468a9751c5d7cbaef3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832508, "uuid": "2e20c7c4-632e-4b4e-b5e6-b3423266e7e2", "comment": "Malware payload (Dridex)", "value": "7f1e822bcb33c330580d29104dd0ba8ac8931f19d559fe6bd2c54a70610bfbf33d158bb3d0f86eadb8d78348ab3e9e57", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832508, "uuid": "6b0873c6-4e3b-4f3b-9c30-d3d74c548cf1", "value": "91F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832508, "uuid": "614d89e6-2901-4063-ba38-b5bef236996d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832508, "uuid": "648a0c0b-15cc-4efc-aa6d-873ef7308707", "value": "3072:rmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:6Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832508, "uuid": "1ac4fa6e-f221-4aae-b6e9-8ed4d63ebebb", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832508, "uuid": "94289d4e-fde5-4901-b8f9-5c64e98108fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832508, "uuid": "3aefdcb8-aaf3-415d-837a-73667a6d1c67", "value": "b8e517ce_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5305bf4d-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621878971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878971, "uuid": "c2b9e5e8-e08a-40e7-9bad-1e367778577b", "comment": "Malware payload (AgentTesla)", "value": "3df469daa0e57cb2963a52380d9bfcab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878971, "uuid": "b0580e04-9ab3-409d-b76a-8abe2ef8a29f", "comment": "Malware payload (AgentTesla)", "value": "bc85f180f9bbf93ebc17983512fc302bb71b2534aa3aae9d721c9ac252fbade9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878971, "uuid": "4816cb65-0ac5-4a1c-956b-3afa39d8112d", "comment": "Malware payload (AgentTesla)", "value": "308d16fd0326e4a24cb2b5b4915e50a7c1ca36e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621878971, "uuid": "b44c75a8-76d3-4ef1-b350-aff79ed473c6", "comment": "Malware payload (AgentTesla)", "value": "43d6fc5ee70e0cd0b7d0cd5f5f047b3d8d4ed0cd034fcbc240ee13609b5d98cdbd48bf920fdb0100c57a43eb82af41fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878971, "uuid": "4106a10b-38a1-4cf7-abb5-5cea42a03e5e", "value": "8C059E1C105EF322C1A8D2798AE4C62BE951EB37B031BD1AFCD727584756F42798227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878971, "uuid": "956c7baa-775e-476a-9e5d-3ffe5f82799a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878971, "uuid": "7bd45a47-a5a2-4002-888a-47190f1c129e", "value": "24576:qBCiJpHvm9KBzpHQhTO86CudjivWnC7Z:qBCi3HeYHIaCugen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621878971, "uuid": "9623d952-24a2-4b68-9448-1efb0255eec5", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621878971, "uuid": "65fee79c-e215-4a3f-9f25-00fa5ce99eed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621878971, "uuid": "3ba9bcca-d275-4efc-b007-40969e778efa", "value": "3df469daa0e57cb2963a52380d9bfcab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cb69b8-bca0-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868449, "uuid": "460592dc-3437-420e-8dff-49b3cbf2d9d6", "comment": "Malware payload (Dridex)", "value": "99c20f00ecd2ba4069d2242beadbbb47", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868449, "uuid": "fc6a4d21-944b-486d-8894-d7408830841a", "comment": "Malware payload (Dridex)", "value": "bcba34c6474b9e3577158f194e5086f16fe6d3869ad2c7457229fe23d843fc84", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868449, "uuid": "861e802c-06a3-41fd-b9bf-637f69d6ec3e", "comment": "Malware payload (Dridex)", "value": "62fbf2d88dcec153a7619e5b51bedaaf4bf20ac9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868449, "uuid": "e901902f-5395-4325-97c5-1e559328dc48", "comment": "Malware payload (Dridex)", "value": "bc012bf956f7ee225ca1968187925e9a76e75b5a783c8d4edf68908567770fa0c942c2740e0c25f42cf074a52a99273b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868449, "uuid": "43a55146-6190-444e-851a-36ed3ea4ecfd", "value": "9D04B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868449, "uuid": "a433f198-3eea-47e1-9bfc-1a7d5031ab06", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868449, "uuid": "e9ab0ca4-20c3-4cbb-bb32-a31be221d67e", "value": "3072:cWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:cWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868449, "uuid": "38fb36d5-30ed-4c39-b00a-ff0bb1e08301", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868449, "uuid": "376a9b12-6597-4c8a-9471-f535daea0e3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868449, "uuid": "dd6d44b1-7c84-440e-830a-802181920d76", "value": "99c20f00_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55b0bd-bc35-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1621822244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822244, "uuid": "bc98c677-79aa-4669-83e3-e66cd20350d1", "comment": "Malware payload (AsyncRAT)", "value": "72be7621f54c64fbbfe3d55188f2187f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822244, "uuid": "e88211fa-872e-42f0-9a48-5ea09d1d0a10", "comment": "Malware payload (AsyncRAT)", "value": "bcddc3f349aad4b263784eec691bdc4cd219de76c893956d682d6d0758c9ec29", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822244, "uuid": "f3f0f63c-e939-47f5-a728-48b9dcd9466a", "comment": "Malware payload (AsyncRAT)", "value": "b31fd8dd700a8721e97edeb35cb13a34bbe3d47a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621822244, "uuid": "44485fe3-e8b0-4eb6-a0b2-3a4dcf67a8ae", "comment": "Malware payload (AsyncRAT)", "value": "2bb714e5568246998c11bd47578b3e9620de191b8e4aefc42d17aef90be7904f8ee69b38925a19b977af05042bbf428f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822244, "uuid": "6d8565bb-bfee-445b-b895-53f5e2cbe455", "value": "CFC47DC47148B8DEC0576E705C36AD70053ABEF92326C2093907376B8937E972A5BD9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822244, "uuid": "59ff02b7-4cb7-4b69-9ed6-b6eba3df2fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822244, "uuid": "bb4f6353-0bd4-439a-97ff-862542294eb9", "value": "12288:2zrcaQCTNMr/TTfsBNiNlQ0LXfk7AzTHxGa:cDnpMr/TwB0NlQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621822244, "uuid": "0fc53cd8-e74b-4305-b649-22afc9fa60e9", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621822244, "uuid": "b7544d91-4dff-4b6e-bf87-d27dbcfdf5ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621822244, "uuid": "d9cc7635-ecd0-4d7d-9bd7-5056201e154b", "value": "Remmitance Advice-24052021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c05687-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861416, "uuid": "22533885-e1e4-447d-b33f-acf6f3bb3b6b", "comment": "Malware payload (Dridex)", "value": "98fb480548229bc64eda81ecf295dc2d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861416, "uuid": "7153a63c-906e-411e-9255-3b73feb2b04c", "comment": "Malware payload (Dridex)", "value": "bd123e9945962d71103f02fe41205660ba5ffac6393ea331eabe2a4e7eb38d31", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861416, "uuid": "be581aea-495d-4163-951d-8ce8d3d48a9b", "comment": "Malware payload (Dridex)", "value": "3adc9b72c5626370241daadcc9e9583a1e2df5e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861416, "uuid": "22e6123c-022e-4b8e-918b-8e0e9f412ee7", "comment": "Malware payload (Dridex)", "value": "8b59ac3d5b1fc6038db74af534bfc2bd8305f84a7b81b911439d59fe2c6c8571add0191303a99259fa62687728d77c62", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861416, "uuid": "a28e5eb0-a9f6-4ea6-92df-db9f5bfb74a0", "value": "DDF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861416, "uuid": "29fc9992-3d46-43e5-adb9-492ee4fcbacb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861416, "uuid": "b19b673d-835f-4bae-921d-16d37147e201", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861416, "uuid": "596c79f4-f7a1-4a7d-8293-188ee78f31d6", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861416, "uuid": "3682a2be-2e07-47aa-9738-3f805c513990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861416, "uuid": "f440a46d-4b66-4f7b-940f-8f6975e88811", "value": "98fb4805_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1b53cc-bc4d-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621832463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832463, "uuid": "292e02b1-3315-4479-8048-b2d69ab810ae", "comment": "Malware payload (Dridex)", "value": "d9fe5ac2b7731322eabd9ca6a55505ac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832463, "uuid": "d9ab774e-fc1e-40ea-8afb-1188850018fd", "comment": "Malware payload (Dridex)", "value": "bd3493ab8dfe9334ae83963571f5dca7641e79217552cd81e4db312410cc5c0f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832463, "uuid": "9e754709-983b-458b-880d-fe93069f121f", "comment": "Malware payload (Dridex)", "value": "66832cee6098c55829355176a27d3f06d0261084", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621832463, "uuid": "0aecd620-029b-41c4-a088-58c9ffb72b62", "comment": "Malware payload (Dridex)", "value": "2b4b8a1c5edec49c16360d0a750fd07c2e99d5122a58ed7238d95c92f3341e0d9b16a7764e6d72b10cd8969aa7f44487", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832463, "uuid": "f309791a-09f1-44b1-8854-c675f92d01be", "value": "DFF3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832463, "uuid": "620446e4-b3f1-492d-9476-2afab83bf03e", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832463, "uuid": "7ddc2504-34f4-480f-9255-63a47bd61af0", "value": "3072:CiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:BeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621832463, "uuid": "42e8abd5-f9ca-4247-9708-1e4aa1512e2d", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621832463, "uuid": "36072eca-8f34-4cc3-bbba-0d2a80a8709b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621832463, "uuid": "fbef5a85-38b8-47da-a85e-da0169aed311", "value": "d9fe5ac2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe687c4-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846914, "uuid": "80808085-9806-4bcf-ab9b-0a3ee56ad307", "comment": "Malware payload (Dridex)", "value": "62d900ecdd9bfa588126f2b8809286fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846914, "uuid": "8ebd1e47-9cd1-460f-9509-d4431577a518", "comment": "Malware payload (Dridex)", "value": "bd9467994f034ca74ebabeea988cdcd0b17a4b7083525e8c87a5c242957eb3fd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846914, "uuid": "2b0ebf20-4336-4785-bc32-b2a0895f2f76", "comment": "Malware payload (Dridex)", "value": "da60fe5349e8fbc758f47bc69ad943e72a780d3f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846914, "uuid": "8cbedb4a-e308-4713-a79e-6f0068be769d", "comment": "Malware payload (Dridex)", "value": "02556c16577bafcb2af2dd1ffcb1f56c8002536ae126f25ae4a646ebf53c2caa1e9044d882d1c3850d20d07030e78d7f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846914, "uuid": "994b8c3b-3834-404c-bd75-a1865bb63136", "value": "EE04E0D0C6C62687E4A7DA729CC17D2A57366809DD29CB329FB6CD13D4A272F09D3063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846914, "uuid": "98815287-ad29-4b16-a9fc-c3459c71b759", "value": "60cac63ce565dc8e9520aaf7ad1d9bd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846914, "uuid": "e32c9191-1c29-4918-b619-dc09912eaff5", "value": "3072:PV/jTmL3X6TLhgZBxbvRS1ebSi75S5NNZ4n+whXVM9MWdo8erj:PV/jTe38LiI4Oi75izyn+4lm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846914, "uuid": "bdbe0e7e-097d-46ad-9c32-cb81e087845a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846914, "uuid": "2cb4c38f-425d-42c1-a935-fab1f771a726", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846914, "uuid": "cb6c62ae-b034-441c-867f-4c7daa71b01a", "value": "62d900ec_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8385f26d-bccc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621887213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621887213, "uuid": "de0cbe27-e1e5-4776-a51d-edf32457e5d6", "comment": "Malware payload (AgentTesla)", "value": "2696a639bfc9f00a8c883d373bfe7349", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621887213, "uuid": "f951ae13-f5c1-4e9e-bf3b-f3923b9b4e20", "comment": "Malware payload (AgentTesla)", "value": "bdcb0bfb38e0114ce635a9b72aa41884e2c3b27e119f47d4807eaaf7a36b2a3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621887213, "uuid": "e117bf21-7e10-46ea-9390-9b9918318306", "comment": "Malware payload (AgentTesla)", "value": "1fa0e497f4b51352d63ce6328b8af5a7f2984e35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621887213, "uuid": "6a6be484-159e-4633-aac8-38092ec16689", "comment": "Malware payload (AgentTesla)", "value": "bb0c1bf1c5585bb4b4ecc846ad959a8bcc911cdb0dd6673b83ea4dca4c13b22ccf0f4cc368f8ee162cbe451914868949", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621887213, "uuid": "aca04a97-3ce9-4771-aa28-25d5d4e99f25", "value": "1EB4E09C3790749FC867DE728A741D20AA30B5B6972BD30B6057226C9E1E6D6CE107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621887213, "uuid": "a803279c-edc8-4806-b30c-7fda0ebb788b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621887213, "uuid": "ee4fb98b-654c-4def-8f5b-6f80fbb8fdea", "value": "12288:LLjHyZ/7fNHpg6UG8n63wCD0ccmGFRw1HdCSLMQmB4Py1rdX:X2ZN2fBgw7cGKHQQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621887213, "uuid": "b01f907b-1ebf-4afe-a810-5589f80af3ae", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621887213, "uuid": "fed3fc7b-4400-4bf7-8695-21dc9f08c653", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621887213, "uuid": "b401a2e9-5bc1-4117-901b-508c6cb418c3", "value": "Order Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c372dbf-bc5a-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1621838157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838157, "uuid": "abfaedf3-99b6-47f3-9312-11bd30200c4a", "comment": "Malware payload (OskiStealer)", "value": "b96b90ff9c9813aa7512e2bb38a78766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838157, "uuid": "8155396a-5efb-4290-987d-98f42df607c4", "comment": "Malware payload (OskiStealer)", "value": "bdce23fe0fa2ff5498bcf09b53315afb9ce0b21f5cedaf2d545be614d0dcaf57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838157, "uuid": "999dad66-31ed-46aa-803b-25085f0103fe", "comment": "Malware payload (OskiStealer)", "value": "a038fee2042acb6d00ee589026a7bc6368e22e68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838157, "uuid": "f655450f-7356-479c-8a6e-a456e8d70c0e", "comment": "Malware payload (OskiStealer)", "value": "19ef97fd6e361ef15deaa214c5c67ddae86113b54269fb0a254f312de62becb21850173ce3377fc220e4dc86d8a11088", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838157, "uuid": "cfaa9f67-48ca-4bf2-9264-692e943563a7", "value": "DD44127F74E14D27D24B4A3124B7EB52CB7F730857B9450FABB40FAE88670836866209", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838157, "uuid": "7bf96659-d033-42b3-892d-75b05c716088", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838157, "uuid": "61e61956-2da1-43d9-8256-f4be1eba1544", "value": "6144:8sBtXz0+4ECY9Nb8QUm3ycgqRq0UP7SinMa7zAuWoRsZ:FtXzlPNbUm3ycgOqP/MIzvaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838157, "uuid": "2572bd56-4381-4bba-a5e8-37242ba594ed", "value": 256966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838157, "uuid": "5f44bbc6-d873-4637-84ab-4680325672c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838157, "uuid": "130f0dd4-661d-42a6-8f36-cbcdf8727ede", "value": "NewOrderWJO-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3f981e-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854099, "uuid": "89f59c54-3411-4ee9-b3f4-1aa4016b6fec", "comment": "Malware payload (Dridex)", "value": "4deab363c7c80c48d10fd92689374859", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854099, "uuid": "5fb6ae2e-2824-4e21-a843-c93538e6cab6", "comment": "Malware payload (Dridex)", "value": "bdcef0c9734fb2d150dffdff56cce53d0853ae496cd10c669167362078fc4c57", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854099, "uuid": "828ced74-6f68-4be4-88d5-d3562eec0d3a", "comment": "Malware payload (Dridex)", "value": "28b9c1a8b0dedcb09e81dd69e96a9f718778493b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854099, "uuid": "461c6ba8-c251-44f0-856a-cb8b045d93eb", "comment": "Malware payload (Dridex)", "value": "c66c9595966b6bb7dd15efa311ccaad8eae6ea3a44fb6bb36d46576b1a427655782dc8e3926fb29cc217297d59a58e79", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854099, "uuid": "d3539f3d-603f-4f9c-b47b-4137824e6ba6", "value": "11F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD0089E50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854099, "uuid": "69c41383-04f9-4bc6-b8de-a8961c3fe24e", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854099, "uuid": "7999671c-1dd4-48ea-9b2b-81835e7d4148", "value": "3072:DmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:yLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854099, "uuid": "eab58407-1ddf-4ac0-9b5e-1d4a2c4529cd", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854099, "uuid": "4c0e3ae5-3c9c-42ed-a2b6-9c097bd3f403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854099, "uuid": "11b93596-9a1b-4d83-8672-551ec8bd4dd4", "value": "4deab363_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "671dd88c-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861395, "uuid": "f61c3d0c-cdef-438c-8b0e-7f7cc0c669c0", "comment": "Malware payload (Dridex)", "value": "d6579abdf1958bf7bb9af6921fb53bc6", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861395, "uuid": "eddf3259-1d18-492d-a4f7-f75858c40593", "comment": "Malware payload (Dridex)", "value": "be045e415cedd7be55fdbe428c691e1061b2a2e400620270fc8e0311d4a8a4e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861395, "uuid": "b468dc80-ae55-4e68-8f65-3c11bf0db5cd", "comment": "Malware payload (Dridex)", "value": "172bf37ba0a6c73b5c1a293368dcda75af6dbf69", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861395, "uuid": "d6a5413c-fc44-4bad-b7d3-42bc0277de17", "comment": "Malware payload (Dridex)", "value": "c18d48ec5d2c5f06971d4e55d6d7f976f46b3ecb03a3bb07a73a29794decbde4f28e65be9e98585d27e972fe56046b7a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861395, "uuid": "51d25cf2-4117-41da-91b1-9d57d6aa695e", "value": "0CF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861395, "uuid": "bb6d1cd0-97a0-4b4e-8e5d-151622aa4536", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861395, "uuid": "f04ebcec-5e5f-42d8-b180-815445c39d03", "value": "3072:JmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:YLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861395, "uuid": "b5be7873-f1a2-4f0b-89eb-c5733b84175e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861395, "uuid": "a5c0046a-0926-48cb-ab7e-2272d56ecc91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861395, "uuid": "0af1877f-5c29-4803-9ee0-355b4c590159", "value": "d6579abd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691cce94-bcc2-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621882873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882873, "uuid": "8f39b2cc-f956-4a01-a7df-d2fc8ff2dc14", "comment": "Malware payload (Dridex)", "value": "a8ce9fdee1746a45fddc7df3cc81f24d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882873, "uuid": "2b47f836-2a23-4fd0-8ffe-c956e3d2357d", "comment": "Malware payload (Dridex)", "value": "beaab6628cb344aa3dc473949b1ed143fd23ed7398fec8c4ea9590fb24700136", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882873, "uuid": "6e3e4a03-657c-4ef6-a5cb-f416c2355e9d", "comment": "Malware payload (Dridex)", "value": "b7401ae8fd3cf84ec6505b4ac8e53ce5e6226d00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621882873, "uuid": "2a4c54f2-a084-44c0-b5c2-4237f9d6e7da", "comment": "Malware payload (Dridex)", "value": "f06399470a7b420b49bfa7b57f3e78d89131a1e4f235d3297ad23cde901989e55f1d01dfad075f5bb329544b772858ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882873, "uuid": "ba2ec0cb-c93c-45cc-ac88-5ea1e6d1ac06", "value": "D8F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882873, "uuid": "4b573cf8-f432-4a17-b136-3ecbfcf93e83", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882873, "uuid": "811270a8-6608-4622-8486-4da774690847", "value": "3072:QmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:5Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621882873, "uuid": "37550f13-b02d-437d-8f9f-91141cd3fa62", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621882873, "uuid": "2fc31619-ad80-49ef-9c6c-1f026d5ad43f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621882873, "uuid": "2e4e6bb0-cd44-491f-829f-eec043d35165", "value": "a8ce9fde_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4878b075-bc26-11eb-875b-42010a9c0053", "comment": "Malware payload (RedXOR)", "timestamp": 1621815817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815817, "uuid": "e5987eea-31f6-4995-aaa1-b15c0cfddab2", "comment": "Malware payload (RedXOR)", "value": "80696c6f76a68641d986e33b535ada57", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815817, "uuid": "8dc48b71-0e24-4b17-9aca-3356676b160b", "comment": "Malware payload (RedXOR)", "value": "bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815817, "uuid": "f8de9340-cb9b-418e-ad63-9eb70947ba2f", "comment": "Malware payload (RedXOR)", "value": "4849547484eb2f77af52feafb67a4e3650b70e3d", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621815817, "uuid": "fdacfa47-f9f2-4c9f-bac2-bcc95845346e", "comment": "Malware payload (RedXOR)", "value": "e311c6e89ef1a558bf4b20b343502f8755fe1588c1ae1647c664887c8bd61da069fa7b3660115999cf9bfabff9cf33d0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "RedXOR", "colour": "#B1ACA1", "exportable": true, "hide_tag": false }, { "name": "Winnti", "colour": "#360AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621815817, "uuid": "1e464294-4c57-4aed-b53b-932bb8e15571", "value": "6013930FBA12D9B9C046F2704EDBC5F9A4B17CF5AF22601B3245772F9A70B24072D669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621815817, "uuid": "4da63115-0340-42f4-b086-aa3705d54494", "value": "768:KPb1J4A0bzQZ1Q0B50/FNu+W9b4ERfHeQ:KPx/Wzf06FNw4ERfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621815817, "uuid": "a5013d81-e466-4159-a827-82fb36ef8146", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621815817, "uuid": "3a067379-84ca-4524-9ee6-1f46bb9db317", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621815817, "uuid": "deacd4d0-e35b-4653-b76f-bc8743433722", "value": "bef08949686c7e8ff93ac0684b0398ff415293f17c040fa83951e310c4d882f3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972c2efe-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1621837853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837853, "uuid": "38781c78-5dfc-485a-8cf2-d1bac444cc9c", "comment": "Malware payload (RaccoonStealer)", "value": "03b5b7852b3722cf173026c172ccd543", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837853, "uuid": "80474aee-bdb1-4fab-a6f9-ef29d882bc17", "comment": "Malware payload (RaccoonStealer)", "value": "befa57a02c2092b79fbb34b7d9cb458cef12ecdfe10f030363ae9d1a13a943a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837853, "uuid": "8b5781c8-e51a-4234-95ea-1643ab5f8112", "comment": "Malware payload (RaccoonStealer)", "value": "f67de89fcbd57c9c48b6f3348fba47b2cba9ce66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837853, "uuid": "48560c2e-3294-45f9-9000-095e8a4ea10e", "comment": "Malware payload (RaccoonStealer)", "value": "34e23f87961800afa2f213aa9781737d254ee3f00df349cb599ebf11b31c2b2356648a1407beaa1621b506ce148ad3d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837853, "uuid": "1d66bcc9-6d57-4128-8e6e-11a91b387a74", "value": "37C4CF2166A0C035E4BFD5F449B5C2BC673A7DA1672480FB22C53AEA52347E4AD3079F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837853, "uuid": "c600bf1c-c7f7-429d-8f7d-db5f2e36b30f", "value": "48d2401545bc23ddf9125d8d09f6c7f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837853, "uuid": "a4a9d930-c063-42e1-bc3b-5ee1f9a4114b", "value": "12288:SGqAe/rdYv3u1YAdXIU2wHRfPkk/FNvS7fDjLKh1mhoEbXsL:xe63hAdXB2mFBS7fDE0XsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837853, "uuid": "48f1987e-aecf-4ab1-a8f1-04e9c117add0", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837853, "uuid": "16d202e2-26b3-4019-aacb-51b27038f7df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837853, "uuid": "af31330d-fb41-4658-a435-6861791eb46f", "value": "03b5b7852b3722cf173026c172ccd543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d589c378-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Quakbot)", "timestamp": 1621821637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821637, "uuid": "c2b5d456-7326-49e2-9ae5-7b6042a7bcad", "comment": "Malware payload (Quakbot)", "value": "8f6e71e767a753a788e7037c180a00c5", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821637, "uuid": "2f7da86e-66cd-41d2-98c6-d299230e41bc", "comment": "Malware payload (Quakbot)", "value": "bf0992dfeb2ad54cb04208a025224dbc75cf5361f4d62a34573ab9789ca62f54", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821637, "uuid": "a08e288d-24c3-4878-b392-412661d9073c", "comment": "Malware payload (Quakbot)", "value": "659f3d8c7ac169c03c7864765476d2e3a4d3a9a4", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821637, "uuid": "68c3ee1b-6966-49f5-99d1-6e21413cb7b9", "comment": "Malware payload (Quakbot)", "value": "f072c0052286b93f9dd30033f222e783b964e48aef1cb471e7af99d6218c67f34fb40e941a6d1b0d0ff704ef744eab2a", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821637, "uuid": "acca2eba-2e03-4bf5-ab7e-8a022089d441", "value": "10F49D23F6B14837D13367B99D1B52AC9C2ABE007D24AC4B6FE41E4C5F7D2817A2A153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821637, "uuid": "f4cb2a10-2f9e-4fbb-b499-fd197eff97c0", "value": "1b9d1b4f16c49288ddfa82ff4146f039", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821637, "uuid": "0ebdf2ca-1528-42e8-82cf-f1a5a2c32812", "value": "12288:yu7x/IO5zob/UPi4ez7lh31w6xzuKuSIKrX1U95RcYPXjS:yQJZ5O/UP+3+Ou+XrX2ZLS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821637, "uuid": "0f2b4b40-8ffa-4577-b719-f3b004671097", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821637, "uuid": "fa0b03f5-918a-4ec3-92bc-ba5d360f4aa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821637, "uuid": "3dab361c-a383-4a48-a374-ebb839d6b00a", "value": "8f6e71e7_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4e1a24-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872307, "uuid": "b6deddb0-a3b0-4401-a0ee-eaf549b41807", "comment": "Malware payload (Dridex)", "value": "70f9bb4d496c0355e50b3ab54818a0f3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872307, "uuid": "a240d900-3fb3-4754-9cf3-c4b076d40010", "comment": "Malware payload (Dridex)", "value": "bf7c5b48e6a909029f4a6023329fe86eea9e2ce027d5dc19f86e5902cac38130", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872307, "uuid": "d1cbda7f-7ab3-4cc9-bcaa-72bd47653690", "comment": "Malware payload (Dridex)", "value": "ef15bec7e07cc7aeb7356e09da2b81fc1f413e6d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872307, "uuid": "5d43ca04-1bc9-40c3-8bbf-04d21de400e1", "comment": "Malware payload (Dridex)", "value": "71e16a0464f4cea2bc2f41d8972feb936d736cb62ec17e167f3fef19eef09c8d7cdd71274d34e5aba346ec5aa867331f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872307, "uuid": "ca92d12e-ea71-4fbf-92ca-50688293ec27", "value": "EAF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872307, "uuid": "d8fbc1d8-220c-4cf5-8d2a-f032e4d2935d", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872307, "uuid": "066474d4-3b6f-4936-8edd-9ae73cd48c92", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872307, "uuid": "fcd37f80-b14c-4d32-9df0-74ede69027a5", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872307, "uuid": "8324643f-60d3-42f3-9bdf-1f8cab49d748", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872307, "uuid": "64679af9-d2b4-4295-be16-54e0d1906df7", "value": "70f9bb4d_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bc7bff-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621850461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850461, "uuid": "9dba23f7-2427-417e-83e7-61f74d0cf545", "comment": "Malware payload (Dridex)", "value": "c2e18fef39f596272070fe2fb9e0e102", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850461, "uuid": "9cf29e99-0060-4d1a-a53e-0c472612267a", "comment": "Malware payload (Dridex)", "value": "bffa895c13d62f7997fe46c9616f3b28f01a35b9af6777fe68d7712bb4c565e5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850461, "uuid": "4961adc9-3e31-41cd-9804-6b678ba14cc2", "comment": "Malware payload (Dridex)", "value": "595b62e30cf7707ae0e60db7bc8ed1734d07f5ad", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850461, "uuid": "07847962-c0e7-42c4-b45d-791e6299d944", "comment": "Malware payload (Dridex)", "value": "7643ff736a5f574d92f2bc271c44463a74070fb634cbd529cebb47619c98195cc0f493e917c1098015507ec343ff9e6e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850461, "uuid": "49808b00-6680-4a2c-9b0d-0328472f78ad", "value": "52F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850461, "uuid": "58cd1b1d-6a61-4a09-beec-9c034fab8c8d", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850461, "uuid": "6b420756-d0d4-4fce-870f-f02a1aacbe79", "value": "3072:Nlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Nlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850461, "uuid": "86477732-69ab-41c7-9f03-74db3c7b0b96", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850461, "uuid": "1c609ed8-d314-4a75-9aca-07b33417a0ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850461, "uuid": "24125319-5ef8-44ef-b9f3-377580fc6cd3", "value": "c2e18fef_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6172ecc-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621872319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872319, "uuid": "c8d4ebdf-6bb1-4124-8d0d-038ac691fc04", "comment": "Malware payload (Dridex)", "value": "ecba2d64f93e68841cd9dd90baf17cb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872319, "uuid": "b21d8fbb-210c-4a78-a120-9b1a8986863e", "comment": "Malware payload (Dridex)", "value": "c003b098fa71cb665ba0d4566ab39f77828e9e8d85367bf799711a7de31aabda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872319, "uuid": "2ec08b8e-542c-44f8-a7c4-a25a45116829", "comment": "Malware payload (Dridex)", "value": "2d6b3ac4305d7b396616296875e8e1d58aa8e816", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872319, "uuid": "123cca3b-acb5-4193-9198-22347ab0d68a", "comment": "Malware payload (Dridex)", "value": "613d3c51663dec3d93704b0e2c8e782852688f26ce39486931358b278cc0e848a7eda8e7f16a38a34825767501c06601", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872319, "uuid": "2589a7d1-b139-4e86-bf4c-561143223c15", "value": "2CF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872319, "uuid": "328178d5-86f8-4ded-9649-5ea068d348bc", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872319, "uuid": "5fadfedb-462e-44ca-a071-c1ed37f8af07", "value": "3072:0mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:dLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872319, "uuid": "582f05ad-49e1-45e1-914e-a492d3dc4b03", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872319, "uuid": "44cfa593-4168-46b0-94c0-51e6b7ce1ad7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872319, "uuid": "71742fb8-fbd7-4340-aab1-12abe26095c1", "value": "ecba2d64_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81d4de4-bc52-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621834902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834902, "uuid": "5488c7e9-9e53-4400-9afa-bd1e096500fb", "comment": "Malware payload (SnakeKeylogger)", "value": "16a6d4f7aedb43d9a9e01e0624ab295f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834902, "uuid": "171c2177-fe70-4aa0-9027-fed4f1adb347", "comment": "Malware payload (SnakeKeylogger)", "value": "c07018ac47b4918fb64cd1d2ec4727fedcdbb09fa4cdf21f33f16f47da422eaa", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834902, "uuid": "67408491-4f8b-4b2c-a143-bfeaac9f69ce", "comment": "Malware payload (SnakeKeylogger)", "value": "3e136906605aec9f7f0c00ea1304ddbea1b692aa", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621834902, "uuid": "d842d344-02e2-459d-8841-8ca80a4db97c", "comment": "Malware payload (SnakeKeylogger)", "value": "a254d7cb4d0d5e35e60a08797f94115442aeb6760ebdad8aaaf7471c97c610192d20d8acc897fc4eed042ec23d9cbb57", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834902, "uuid": "105c3358-ee55-435c-a0c5-327c56815292", "value": "CAC423D693C8E82B827E5B29AB540D025E17DDF0DC37A80F4FA29CBA10953D7D45A4CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834902, "uuid": "53391a8c-3b49-449d-82e2-8b601ed0e92b", "value": "12288:02GiXgzJ9qpMXOnlgD4PvaetGts9imQlFr3E4d7LxYEdrqAR:JCJO5n6D4PvTtnYmQltUyShu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621834902, "uuid": "3c7cfe46-1dad-4ff8-ab2b-3c5dedba8cfc", "value": 573910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621834902, "uuid": "1791e23b-3bee-460c-843e-048cfecf2be1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621834902, "uuid": "51c7ebce-2298-401d-a9df-c32cbc077c25", "value": "TT (Ref 018006 6743).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a708a4d-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872541, "uuid": "b1c10a83-bad7-4930-8a5a-b891d5c6643c", "comment": "Malware payload (AgentTesla)", "value": "559b60b350606d3b2e6b8a9204a24433", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872541, "uuid": "b0bef1da-f566-4b94-9ede-d822db1ff567", "comment": "Malware payload (AgentTesla)", "value": "c090bafae5614448edfceed61a0d782733a5bc4da85d324d2b077cdad7f63946", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872541, "uuid": "3ad06da7-3487-4c03-aef0-05d91999892a", "comment": "Malware payload (AgentTesla)", "value": "cb69a6a774f27105a02422f5946c7ef9267d8d54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872541, "uuid": "6e17e7c5-0471-4270-915f-271d6142f37a", "comment": "Malware payload (AgentTesla)", "value": "b9bbf905a5c18b6a59895651b353407e72218f7a6c89eb90bacf2569f4070970a95df82928aa560d004fbee5f6508363", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872541, "uuid": "3dc9d3b3-5814-4673-af3d-d542fdec61cd", "value": "02058D1C516EF322C198D2798AE4C12BE950EB37B031BD1AFCD727584B5AF41798227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872541, "uuid": "b4c527ca-5579-4170-b4be-c9865333178f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872541, "uuid": "2cb9d9c0-b05a-494b-a5f7-f07876537eb7", "value": "24576:oBCfjYBvMTjgDX1Qo+uaplK1SmyglvVQt09:oBCfBjWGt3K8RgdCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872541, "uuid": "dc8b202a-60d7-49df-9b8b-68099da02e3b", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872541, "uuid": "a690c051-51e6-4bb9-af50-6ada2aabaaee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872541, "uuid": "ae2ce184-be65-4ca1-8c88-864115cf2123", "value": "Paid invoice-98686.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf0b9b2-bc5c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621838964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838964, "uuid": "0c9ba019-1306-4345-aa5f-6cbcf5ace1b8", "comment": "Malware payload (AgentTesla)", "value": "1d3f2b322238e732644a63ad57fbbeb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838964, "uuid": "09039af5-f62c-4857-99bd-647d32e1840f", "comment": "Malware payload (AgentTesla)", "value": "c0937a60690a6c70c39714dba77dc139392f93f7ebc2108856ad326934e38813", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838964, "uuid": "91f191bb-c4b3-47a7-966c-ff9a6a1ee736", "comment": "Malware payload (AgentTesla)", "value": "3652c6ac0ce153cb563d4b0b3292c1967d5ec736", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621838964, "uuid": "4e69fcd3-939e-4e76-a6d7-b2937911b834", "comment": "Malware payload (AgentTesla)", "value": "1819747d9a8cb35f7746b84eb63bda5c777529a255d390fbf26d26c752f3eebf3deac3611c5cf2ff54c0d466f4df36ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838964, "uuid": "657e73c4-4b6a-4d8c-9ab5-16a04361402b", "value": "EDF423D6FAD738A4B211981762C0F2062DEEEB41D18513C8DE74E871ABEB46F9B43171", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838964, "uuid": "0268c8d9-08a2-4865-bfe5-7ff452c61801", "value": "12288:N8hYMXQze6toUknLn8LVN4b/A2V/rLxGUX25DhEVVkXrSFU3xFrvcSC1RCooPPnv:yhYMXue6t4wZNnW/rLxGZfvIOFrvk7CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621838964, "uuid": "91fbb4da-e04b-4112-abd7-26b611669fb1", "value": 750049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621838964, "uuid": "e8def780-f110-4be1-8ba8-33773dc93208", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621838964, "uuid": "9207c182-4a0c-4be7-a6b2-c431d3aed553", "value": "DOC.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3add90de-bca8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621871629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871629, "uuid": "89299a40-5672-453b-995d-d0d8ab53cfca", "comment": "Malware payload", "value": "478d829cb404d07a0e887c5bf497a63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871629, "uuid": "18ecf159-01e0-4035-9526-ac7d4d77dc7d", "comment": "Malware payload", "value": "c155953124135f1a3cf912396c345419a7995fb820ea2bb29590de2d48e41df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871629, "uuid": "3d03a8b3-c5f1-4de5-b31a-30701d85aa04", "comment": "Malware payload", "value": "5edf67819e6806439d0db15ecb4c822e87b9ae9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871629, "uuid": "a05e64b8-b363-4a12-b0ec-b4e6acdebf23", "comment": "Malware payload", "value": "a77ee37cfe9243c11ef3d609c6a343b5c57b72ee3365f99a5d976626c7bbbe0ba2cb2bed3186464219bcad8a6a41b780", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871629, "uuid": "b2570d3c-21eb-4d65-81a8-b22a14e2c95f", "value": "DF643E4472FA2F86F4799BF812A3602087F76A2A286EC75F9DC335D72672F044920D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871629, "uuid": "7f6080f4-082e-4afb-b1c1-7834115ae111", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871629, "uuid": "114cc28e-b392-4792-9c43-03f9cfa6f9dd", "value": "3072:LJV1LtMXKSk7QIzH5bssgaeFkT2tAxnQ3+HzYvh6TQtvdJG0ZBdEor1jNAGOwA8G:LJ+CXVqkIAxamc6TGPBXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871629, "uuid": "393062de-64a9-4f6f-9710-20ba4d6bb3c0", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871629, "uuid": "1a1d7534-55eb-43cc-ad10-9c8b36544858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871629, "uuid": "0c47e89d-8394-4cfa-b4ba-1fad02bd1332", "value": "00090090000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40445aaf-bca5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621870349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870349, "uuid": "86727500-94cf-4f90-9599-74fa109a526a", "comment": "Malware payload", "value": "f634a6113754b2b40d2328ca4915a243", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870349, "uuid": "1bd8dfd4-185b-491c-9080-b5bb1794de32", "comment": "Malware payload", "value": "c19402ce537f9c7a2511484cdb5160719340543c11ae17b60ce2e1706173ceaa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870349, "uuid": "d117a462-25a7-46c4-b2ae-a3e7a5fd3bbe", "comment": "Malware payload", "value": "b1cbcebdd4e46d73efdcdd238463c382dfeaa7c3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621870349, "uuid": "69b78a83-ae4f-4a88-a362-566bf91199eb", "comment": "Malware payload", "value": "55219a1962a5e80ae32cffcad88a5d07792bb17b1894f09d06bbc01083232019a3a7a7d974d446de87e6c959337d4b90", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870349, "uuid": "f7da1c85-5805-4b7b-92be-1bd9494d42f7", "value": "23C52340BBD188B2C2721DB31A39AB25553D7E201F24AEDF93E0692EDE711D1A734727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870349, "uuid": "6e95c87c-4160-468f-a191-f143264fc2af", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870349, "uuid": "e2661232-a290-4c8a-a436-0c89addeb628", "value": "49152:C3dRg6TR8Wwzf+EAAICZv/UWrfVRGG3jM1vfg2071cgZDY:C7gK4mEAAdbfVV3jMX67ygZDY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621870349, "uuid": "dc24a9a1-b387-41d3-828c-59cabb83ce0d", "value": 2587938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621870349, "uuid": "ab8cbfa9-cf52-464e-a264-c33e326e5b09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621870349, "uuid": "34746710-5beb-4031-8872-df12a53a7aeb", "value": "DHL AWB 60073535404.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ff77a2-bca1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621868638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868638, "uuid": "99fd3de0-134f-4dce-944b-711d7527eca4", "comment": "Malware payload (Dridex)", "value": "2eecc446c94eebb323e6f73e2aa9e4ee", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868638, "uuid": "b32e056b-50a2-441c-a4ba-3e2c93048340", "comment": "Malware payload (Dridex)", "value": "c1e75cbd947bae4011ddf339a5c2448f26b1e8b473d885090d3785494834dbb7", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868638, "uuid": "233ef3f7-8998-46d7-b096-82dbed417edb", "comment": "Malware payload (Dridex)", "value": "0bd18ea3aa0a2d435ad217c12f00c704c737a423", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621868638, "uuid": "d1cf1665-611a-47de-b303-9ad48623509d", "comment": "Malware payload (Dridex)", "value": "eab550b4ae1f8d2179c533a31254b04eeb8776de4f84bba522d4e598bd9082000a6e3f686e872cd5019013d0a918737e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868638, "uuid": "df4d39ec-5704-411a-b37a-652f8cc55afd", "value": "28F3D088CBB3E4E6EFB3D37966F85E1B461174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868638, "uuid": "469833e9-1a3c-4bb3-ac34-63c1aaf9b40b", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868638, "uuid": "888ece87-1de3-42be-b3da-2f1a9fdd244d", "value": "3072:fmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:+Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621868638, "uuid": "adafedfc-40eb-498a-8c70-a646c6677a16", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621868638, "uuid": "60b022c8-87e4-4a61-bc94-093b9ac9ba08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621868638, "uuid": "dfa3212f-fce5-4fe3-9184-ffbabf6c5817", "value": "2eecc446_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bddf64b7-bca3-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621869701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869701, "uuid": "43bc1f20-762a-4200-bab3-810c82bb26d3", "comment": "Malware payload (SnakeKeylogger)", "value": "698a1d89b9f2e36a299d3729981f3fdc", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869701, "uuid": "19464a36-7b21-4d12-8377-add9a61b7a30", "comment": "Malware payload (SnakeKeylogger)", "value": "c1fb531700b5957581db056aa69fd8a2acb4f352a4faace196290588fc27790a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869701, "uuid": "450a1fa9-c85f-43c1-8ccf-c2d94a55d698", "comment": "Malware payload (SnakeKeylogger)", "value": "7a1c95fa601c5a87bebdfc7d44b976200a607eba", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621869701, "uuid": "648dd4af-a90c-479e-b4fd-66d89a7e1731", "comment": "Malware payload (SnakeKeylogger)", "value": "10f768f0f307c069321272caf6356a18687ad10a7dfd74f1a562ce3ef2e981c25e14a5944179f109b67049edcd020b89", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869701, "uuid": "5f2077c2-5cfa-4595-9cc4-ecb8e932a1ec", "value": "5E15C06C325875DFC56FD27AD9680C68AAE174679317C20BB52B00AD9B0D9C3EF205F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869701, "uuid": "86c831a0-ee7e-45cc-8367-a121343dae50", "value": "12288:2EjB0Vymko9vAhCKl9/y4JSkxzmm8wP2k5Y0TmLHiheoqYCYUKzNJJvPVYnCjxyp:2EQdj94hC+9lx6mLx5/TmkXqYCUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621869701, "uuid": "9edfd719-ff7a-4fda-b640-c06a29b6993b", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621869701, "uuid": "7a47b2d1-5981-4cf6-9b92-dfb7413ba3ee", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621869701, "uuid": "06daa12b-9c89-46f8-b539-58302a0c4017", "value": "New Purchase Order.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d011f89a-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621837949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837949, "uuid": "e3e10da7-f7b4-439c-ada1-1d2a31c7f726", "comment": "Malware payload (AgentTesla)", "value": "c6f5601ba63581dbe88d49dadbad66ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837949, "uuid": "fee2c141-9ad7-4dc0-97ab-55bf60a17e60", "comment": "Malware payload (AgentTesla)", "value": "c288fba4b7716faf5562f4608d8ad0c1755ae059ba3d69569b60cf38a5f6f695", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837949, "uuid": "0c622fe1-8bdb-414e-9b25-78946dcea806", "comment": "Malware payload (AgentTesla)", "value": "da41c69903e31a80a6fbe5f3f61ef8c613b4f9fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837949, "uuid": "32d48613-0301-4267-8368-5c3735b654a1", "comment": "Malware payload (AgentTesla)", "value": "efb36be0024afdfa5869afcd0c4e97fb3b3cac7b02c289e4d5b449f6154f72f90c899ff516b1435865692d0a4b4179a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837949, "uuid": "75b63b28-f871-474a-8342-11b303d94600", "value": "BF34124A62C9D4A7D7A756B12FB7E776E3BF4B403AB10653D7542CAF6822043842324B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837949, "uuid": "153b144f-6029-46d2-83cd-3cf8c0a34c6d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837949, "uuid": "99a1e2b5-5a88-478d-b183-f639bc23b1f1", "value": "6144:Ds9TxsT4oiRW8y92tGmpDs7cR+UOy+AK9b9:yTe4BURCDpg7vVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837949, "uuid": "18beb765-870d-4797-bb49-53b797d20a94", "value": 238433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837949, "uuid": "32b2af99-e0b1-49a9-81de-2ab69ca3674f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837949, "uuid": "2c680564-da28-4b5b-8375-0da560a63f1a", "value": "c6f5601ba63581dbe88d49dadbad66ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "628c7177-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836047, "uuid": "765fce38-0349-4c84-a211-60ec22000f8c", "comment": "Malware payload (Dridex)", "value": "4493b535a1dbb34ee6683bf7f74305da", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836047, "uuid": "94121343-645a-4d5b-a4b6-e186882c33c2", "comment": "Malware payload (Dridex)", "value": "c2b4cc7fb4753a33af279da5f0ac56852340e909230ffde6cd56b875b0f10b7b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836047, "uuid": "ebf1385f-4f13-4e02-b3d7-d97dd7c38b32", "comment": "Malware payload (Dridex)", "value": "d1288889b00d8e19cfdc51c8fb2443c9b5ad71c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836047, "uuid": "8a89e52c-2094-466b-9b5d-045dfa353098", "comment": "Malware payload (Dridex)", "value": "444ad44bff3643e206e0903cf82e8a12a81e7860345268ca0fe34ad12bc83fbad0f86f702b1f4001fd485191f4a4533b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836047, "uuid": "eb20d995-3c17-448b-b8c6-6aa39654fb9d", "value": "BBF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836047, "uuid": "8542c8b2-04de-410b-a49a-98934eff24eb", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836047, "uuid": "b628eeab-7442-4379-8395-ebcd6ad6422e", "value": "3072:amNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:LLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836047, "uuid": "9bddbf36-6c8d-44e4-8313-b38f919d2b26", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836047, "uuid": "ac4bbf1a-260e-42e5-95ca-99149d1c3574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836047, "uuid": "c30c1d0e-c819-4d94-aca2-05f81c746a02", "value": "4493b535_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9778679-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872781, "uuid": "35264b7e-a783-419a-b1a6-91067bdd3c8c", "comment": "Malware payload", "value": "fe9631647825c20bb4caef6da6a62c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872781, "uuid": "d07179f1-20da-4a74-a3ec-302ba41f5824", "comment": "Malware payload", "value": "c2caa398fcdf957c62ad36ef69c37f25e8c6e698af4e215307afbf5ac11a525d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872781, "uuid": "c35ef355-f9c7-4580-8a68-2d2a380b8e76", "comment": "Malware payload", "value": "41cce5d628329c7e0413ade53dde5785c7685ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872781, "uuid": "e9af8563-7c24-414c-a6be-42977fe4d0a4", "comment": "Malware payload", "value": "b71bd917bfd115ad8b87779fc4ee09d7e27aa3b39e133dcc15c03956580515b77d5db0238a8736583a60cc83d1891f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872781, "uuid": "efc736a3-b6c1-4b6a-a728-31fd9ed338c0", "value": "29B5FE1E26E92D26501DEC9987F0097376FCD8B6396411D8844F30AFC14AEA6C9B637F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872781, "uuid": "9ce9007e-b1c6-49c8-9b88-72a963097e29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872781, "uuid": "b760ee36-a459-4317-9d7c-aef716c55bae", "value": "1536:XvHnoJidSLFXxkAG4bOD9dD7E1zFmgZ/GOpguYCWrHRyG3o8nWYkJzCtX5jwYfVP:XvHoJGSRXG0gd6zFG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872781, "uuid": "22355ea7-3bba-4001-b2a5-c664421269ca", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872781, "uuid": "d3265c17-1cfe-4159-9825-06cb069ff29e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872781, "uuid": "363838a6-81a6-417c-8c79-2653dae05d43", "value": "41000548564100054851.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a136e0b9-bc86-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621857198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857198, "uuid": "62bc13a0-a52a-44b0-a412-dff36803103e", "comment": "Malware payload", "value": "ff3af2964a9ce8759d189e29e5dc232e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857198, "uuid": "01cc0581-507c-4020-b90d-af06d96b0a02", "comment": "Malware payload", "value": "c2fe1cffb4e802602cd38ec484ef22a9794e6570b577da55f37ace7675f0bffb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857198, "uuid": "88e8aad7-babd-4d23-a1a4-8682b0210439", "comment": "Malware payload", "value": "c2edf731d04ed8fee4b8e1c41c622d5f7ae71fb3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857198, "uuid": "bf893524-c4c6-44e2-a663-c628ec45aae2", "comment": "Malware payload", "value": "361f9f39899ba5653990247d5447de39b918c6d0371e4dfa151d7aa0c4ff3be3a23d2811b90abcb9eb7438411bc250ca", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857198, "uuid": "5a1b554f-e9b0-462f-b46d-4dfcf1040e4d", "value": "EEE4231B80408E33E1DFB1FB4368A59E523CAA740597964727DBD83639B652FC85809F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857198, "uuid": "452ca33a-b924-4495-969e-20d997e5c9a1", "value": "12288:X//ZIHSQcS99RG/+5mH5Aczi8dER8R2S8xXdMOa9iYcgInCH5IU4omReBDBVCc:+yH/maGMlSyR5AX+J8xgUe/8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857198, "uuid": "124d42d3-2d77-4692-9d32-e2b18be17b2c", "value": 704744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857198, "uuid": "f38a93d4-2e12-4b48-abab-5074c5201934", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857198, "uuid": "a6ad692d-bf0b-4bc9-8e12-8c34a73899c4", "value": "Frank 8.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eeb4c5d-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621886587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886587, "uuid": "178f211c-25e4-4f72-bda4-6cdb591702a4", "comment": "Malware payload", "value": "df7c28812064752ce03cbd6fe7dd5f22", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886587, "uuid": "4047fbaf-b58b-4d31-859e-918a12de53cb", "comment": "Malware payload", "value": "c449db0920c24f078182e6e760396d3aaec5eee0592017437ae21a59eb50431c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886587, "uuid": "93c1e352-8fe1-4f60-80f8-c7c205d03481", "comment": "Malware payload", "value": "564f865085c5264bdd76703f08a8702c1b342c74", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886587, "uuid": "612a8d2d-0fb2-41b6-bf39-7278ed54ff6f", "comment": "Malware payload", "value": "99947a80b1cb842babf98481d6ef3b802ad1ece0ac6773689e4f2bf4479c3083a5e2df9d73689de5cf4b7f0ea9b1f5fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886587, "uuid": "b5f4d05e-1d78-459a-baf5-0484dd6ca58a", "value": "D9F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886587, "uuid": "dfb93768-7f56-4747-8fa7-d433c7a0ce39", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886587, "uuid": "1c8ad52f-3aeb-46b2-87a8-b6ab03750141", "value": "3072:FmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:ELc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886587, "uuid": "21ebba80-2786-4b6b-a03e-034e03b29c80", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886587, "uuid": "1cf443dd-a28a-465c-9a54-e5faec62c5bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886587, "uuid": "3f0b8683-114a-4e2e-98e8-d2b90318388a", "value": "df7c2881_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c61da0b-bc6e-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621846855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846855, "uuid": "af353f02-e37f-4799-9f17-06bf235b8d22", "comment": "Malware payload (Dridex)", "value": "1a0c772cf0c282e38d48db4b3478d6d3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846855, "uuid": "5ccee94e-8779-4e0f-bf05-f34779ffcb15", "comment": "Malware payload (Dridex)", "value": "c482bb3bed604cb2350c95b944a6e4095556414cbdb1183eae4d2cdcf32a8706", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846855, "uuid": "677b23c5-2388-41df-93e6-88a8b45c66bc", "comment": "Malware payload (Dridex)", "value": "53b567c5b2e304f32760f4f24840ce3e9ce5f105", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621846855, "uuid": "b76f86cf-7194-4299-a06d-2e4756f968da", "comment": "Malware payload (Dridex)", "value": "62af79576bf33c814e413a458750f0993bd1bb7af9904cef7a7a805a453a5934242d3570ba9c1a488e431c0f2e0b7926", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846855, "uuid": "51fcac71-77e5-4677-a5e4-7394eb44757a", "value": "4204B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846855, "uuid": "01f7ef3c-669d-4343-a9dc-6e636e4aee2a", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846855, "uuid": "6378d193-cd8b-428c-9a46-020ad2da5d05", "value": "3072:QWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:QWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621846855, "uuid": "4452b9ff-d5ec-4eae-b13f-87a2a38b07d8", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621846855, "uuid": "58d93f88-da99-47f3-bdad-e386c9253881", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621846855, "uuid": "0c0d96fb-c5b3-4dda-98bd-681ca2c45703", "value": "1a0c772c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509871c0-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621861357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861357, "uuid": "f76dfc3c-4b07-43be-8fed-51fc5fa81a48", "comment": "Malware payload (Dridex)", "value": "b75b4892ef32a8cc04472ec8c430c9b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861357, "uuid": "c4bc95bb-df9d-4960-b510-9734760c4fd9", "comment": "Malware payload (Dridex)", "value": "c4c82c1b591e45aa240cc8820bab99aef8c09c3045ca7b53e79ccfeb2ede28c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861357, "uuid": "70132171-92e8-4c4b-99ab-620dbbf60eb8", "comment": "Malware payload (Dridex)", "value": "4c1d873365ccd94748f37d177f3658a5a1097118", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861357, "uuid": "f0036ac6-5482-4c58-9a5b-8a687764f0cf", "comment": "Malware payload (Dridex)", "value": "05561c3a063a0143c87400f75c452cd555f5dc97f07b6f108541ade0042a43435d29ab84745bcadd10a6405ee11a91bf", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861357, "uuid": "33fa101c-d3ad-462b-956d-dd6b5eb31f38", "value": "3EF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861357, "uuid": "b5deba79-328a-49c5-b47c-591bf65b4db7", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861357, "uuid": "1c80253c-2d7d-49d0-8131-d0fb7023d990", "value": "3072:GmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:XLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861357, "uuid": "a1e3a1fb-ca65-4fb0-b0ef-20b1f4a349d3", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861357, "uuid": "ea9e812d-7ec7-48ed-b79a-406dafd2289c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861357, "uuid": "8ad9c360-8fc4-497a-ae0f-015b77d062e2", "value": "b75b4892_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e398a53-bccb-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621886613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886613, "uuid": "b76dd971-e799-4788-85d6-8bfe85fac35b", "comment": "Malware payload (Dridex)", "value": "ff89625576c1883534f4966d48fab223", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886613, "uuid": "6921a2eb-04c6-47a9-a434-083ffe664db0", "comment": "Malware payload (Dridex)", "value": "c4d75d76992be3b91cfe4351623597f29a5760e878322df8ed120fadf881e02a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886613, "uuid": "10e1b204-9ee5-4150-9487-a6a2a280f3a1", "comment": "Malware payload (Dridex)", "value": "e37068d717c1f881c38e3645c07208eb3cb438c7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886613, "uuid": "30cdd9d6-671b-4939-81ef-598d00e99e45", "comment": "Malware payload (Dridex)", "value": "38a941119e7e2941567dc8b6fdd18ecfc82ba331b5bbba910adc1e40ed1cd46074a690978cefbd0f76fe3072745f38e4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886613, "uuid": "fa7515d5-ac38-4af9-b051-3c73e024d6ff", "value": "54F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886613, "uuid": "f84f43f7-4695-49a1-b636-8d669d3718f9", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886613, "uuid": "c7183532-1669-4afb-91d3-e31b0cd301ca", "value": "3072:VmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:0Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886613, "uuid": "278e19fc-01af-4552-8c77-731164974086", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886613, "uuid": "010df542-2c2c-4e79-8dc3-9ba5b961c737", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886613, "uuid": "d0c9a98f-8847-41fd-bcfd-12393d6bcf3d", "value": "ff896255_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cc5f21-bc9a-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621865661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865661, "uuid": "4beaca10-5eaf-4d2d-b433-f64e32a50bee", "comment": "Malware payload (Formbook)", "value": "004dd694f287411063bfbfd83d528916", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865661, "uuid": "bd3ab072-16c6-4c35-ad47-d8f77846f587", "comment": "Malware payload (Formbook)", "value": "c5425b8f9762f3acf7d1accd773336c78c4daf5b1fbde2f160787c584c5a5e53", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865661, "uuid": "7a943384-e894-451d-83cb-a20b198d83b8", "comment": "Malware payload (Formbook)", "value": "d0f4d8cf3ab449cbc5549c20e22b412057a2afa2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621865661, "uuid": "e52296f6-ed52-4469-8c21-e29d72f0b8cc", "comment": "Malware payload (Formbook)", "value": "032ad2ee3eb06808414cff9dc775511153caccaf5c9676a467b59fec6c02633c55ee33c0f26d8d7c72e49c727721e32d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865661, "uuid": "904fe5c8-91e0-4cca-92e4-13005b581123", "value": "93A42301D8FC5BC88517DE9752DF8F617EFB843AC0CDEAC982FEB2912128484796E491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865661, "uuid": "763496c7-4571-4988-bf93-af0b07b46c5e", "value": "12288:vWEMJydl/X+OsIE/0j/BnIYp9K/ngEIhg5lg5TT:+gHfsIE/0Btpg/nHIhSg5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621865661, "uuid": "9fcd784c-ba1a-426f-9151-1b57ed2396d7", "value": 490875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621865661, "uuid": "ce747199-9635-4f00-85c0-187aac6d7be4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621865661, "uuid": "f2741032-438b-411c-9b3c-de2088aa3658", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afefba5b-bc80-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621854645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854645, "uuid": "e2d0bafc-0c2f-43e7-b795-f3454a32f596", "comment": "Malware payload", "value": "1e7da134250d5fc83993e9d596ee9546", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854645, "uuid": "86804be8-b953-40af-8cd6-f59a1d6b597e", "comment": "Malware payload", "value": "c55d6b353edd01279c353d4aa092ebe265792a2277272a7a51901e0964544529", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854645, "uuid": "dc3e6165-d1da-4156-9814-ac0f04dd34bd", "comment": "Malware payload", "value": "bb24a1737b71291e52860fca4084f15c44257a13", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854645, "uuid": "3d63e650-b3ae-41e2-8794-50f7c3323545", "comment": "Malware payload", "value": "b8fbb103285d55b4a75138869f265bf28f18ecd1abf2e23981e51c4f0ce3178a60b83a9c807e6cc7981ea83193f7c860", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854645, "uuid": "2e10b576-2456-4d35-ba99-30a33a1a3846", "value": "0AC2D064E441781DC1DB28BF84171DDDE45A3081A614AB1FB538A074DFC0D9367CAB1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854645, "uuid": "b2c12067-2788-4db4-8afe-7edc9c905700", "value": "384:D0AGby8RuufBMIslErMpFSA4SNrElzCgsmBLVYfaxVbPzaegHmiLJ:w/by8RxfBRMWtSNrEognBVYmVva3mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854645, "uuid": "f6db536a-6927-46cf-8e7a-1b9a5895b952", "value": 26244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854645, "uuid": "bd5a3609-72bb-42e5-b6ab-91ee59b972c3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854645, "uuid": "47b34dd2-87db-4f1c-bce4-6fab8546a79e", "value": "SUBSCRIPTION..docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50648ff-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621875753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875753, "uuid": "386011ed-e7f0-4497-b4a0-7dce76974a2b", "comment": "Malware payload", "value": "1aac9cf3149884b633627f2d571a68cf", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875753, "uuid": "35421e6d-cd62-4f35-b992-fa670e33f20e", "comment": "Malware payload", "value": "c5709b27757929c61ad98b5beddb70e69744709cc666ac6f9daa90c7eaecb40b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875753, "uuid": "d5d614be-ff81-4d0d-a19d-e1b212789cab", "comment": "Malware payload", "value": "77be7d411886d31e74fe24573748abe2a8ad7d77", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875753, "uuid": "2a8efb3b-6ad1-42a7-936c-72db68b7b994", "comment": "Malware payload", "value": "7400714fe3869b5e0f98be921ee69851f36af6237898ba7f11def76bd61d4560609774bff5b93f98c71edbb3e00eaebb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875753, "uuid": "a53a2a3d-0c36-434f-8556-2b2bdc7272cd", "value": "3FF3D088CBB3E4E6EFB3D37966F85E1B561174551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875753, "uuid": "c2890f70-649c-44ff-b543-b1a2f4c9f136", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875753, "uuid": "ba491915-52de-47c6-895d-2ecee120b032", "value": "3072:kmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:tLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875753, "uuid": "91bb4e75-2f22-4961-bf26-4b645a554a29", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875753, "uuid": "88117f68-d57e-47bd-a71d-23d8cb678f7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875753, "uuid": "d2fe8817-a619-481a-838c-14a1a3b842bd", "value": "1aac9cf3_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b3170-bcb9-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1621879051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879051, "uuid": "f96345d6-2c4a-49c5-8ec8-4bd22f8b7384", "comment": "Malware payload (TeamBot)", "value": "77aef72b89a54673766f8305dbfcce6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879051, "uuid": "f02668fb-1592-422f-a526-c2955700b453", "comment": "Malware payload (TeamBot)", "value": "c5e7c2f3efd209636294e9ae666d8784f63025aae3a3ba437e4d0c975dc9366c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879051, "uuid": "e6a14865-a161-4857-95f6-07160dc6e2a8", "comment": "Malware payload (TeamBot)", "value": "4eabaff5838bac2208088ed2b8fc5d969c605099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621879051, "uuid": "836b32ee-ce96-4b73-90fc-5d20133a883a", "comment": "Malware payload (TeamBot)", "value": "a72db1326493f34cfca56eddcb2a6a1f19e74e663f1e8c5de321787b9dea5231520d7b6d8145cfd8f19ea56d9bbd4e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879051, "uuid": "acfcd5a9-de7c-46e7-94c3-8098039aa5cc", "value": "4A05F13066A0C435F4BB26F449F592AC65257DE06B2580EF2EC53AEE06356E06D31F8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879051, "uuid": "7a4024ad-d049-4530-868a-5aff1230c496", "value": "2c43fac1d0306640e95fe6ef1ec8f89b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879051, "uuid": "b2caeae3-460a-4dde-aa65-11caae583304", "value": "12288:/W5BqlBJpOTx1L9vFigcJJVOBSLuaklMgb1odghlxgaArX323lFuJ29kMDAZo4AQ:AqGTj9glJJwBSahYHD321wJozDGo49N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621879051, "uuid": "9a64c4df-fc9c-49ca-91c2-41d62cba6bec", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621879051, "uuid": "9ae33340-db6c-4cbf-9d57-6808bc6c9b2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621879051, "uuid": "164c708f-0623-410c-afbc-3e5e209750b3", "value": "77aef72b89a54673766f8305dbfcce6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10d8f5f-bc44-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621828851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828851, "uuid": "f6d7904f-1f54-47e3-a58b-b0715e1ae133", "comment": "Malware payload (Dridex)", "value": "0e8c675bdadb00a3bfa0daf4cf49e1b8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828851, "uuid": "d9a2f489-7bca-4dff-8c0b-e68eaa74e9ae", "comment": "Malware payload (Dridex)", "value": "c619d6630d82ea5df2ac47bf7847132310b60c02bcda7dbbe2b68ae73afd871f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828851, "uuid": "d80e0823-d784-46ab-a4ba-a600a1c9817b", "comment": "Malware payload (Dridex)", "value": "8cb950ae1869fa501305ceb44a16c152577e80c6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621828851, "uuid": "6ae80a68-3ea4-41a4-b92b-dc70145e1034", "comment": "Malware payload (Dridex)", "value": "e0ccf0ebf0ae1bd4714e4a60deb7e011b8dc7b6c4773e76f68e731c10d5c80bf501a29f49acb3ddd717397913f69cc39", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828851, "uuid": "a8f29319-2b6c-4454-bdfe-d804bf6d6f18", "value": "23F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C5846E9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828851, "uuid": "8ba0b8d3-9d18-4a52-85c7-71f1c44ab611", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828851, "uuid": "4ace85c1-3840-45d2-97e4-1e6c03897a6e", "value": "3072:UiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:XeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621828851, "uuid": "2e67ccdf-f2e0-4f37-8d7a-9695c3acd93f", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621828851, "uuid": "1ba768f0-e04d-4c27-8fd8-e657501e9e24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621828851, "uuid": "ef93295e-c1cc-45ea-bd93-807289d22d81", "value": "0e8c675b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37287c3b-bc23-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621814500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814500, "uuid": "a3ee7d11-0848-4f6b-a011-57f63928beb1", "comment": "Malware payload (Dridex)", "value": "addc351321a3e6f6404cf7b4ccae99fc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814500, "uuid": "79841d24-e13e-4fbb-b598-cfd456487a22", "comment": "Malware payload (Dridex)", "value": "c6532cefedd356f02f20ae6c58bab1ab56ad3a334ec00bf7b5ada3cbe3f20526", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814500, "uuid": "089283b5-35e9-4a5d-80fe-055f3f1daf64", "comment": "Malware payload (Dridex)", "value": "70ebf82f51391959d3905676e587726877c7b284", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621814500, "uuid": "7d2f8d48-f3a3-40bd-a5b7-3e6b6f6779e4", "comment": "Malware payload (Dridex)", "value": "7fcc8e195fb3dadb4f0965900909cd3eace2a893063437a95466e2b12b8e9f7a356848ab096db53ed87219e4578ba716", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814500, "uuid": "62e12ca9-82e0-40e0-bbe4-9568f59a3bb6", "value": "3FF3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814500, "uuid": "15d46208-98c6-47fd-b20a-eeacef09306f", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814500, "uuid": "ae9c0b96-4ecd-4a4d-9b07-b2d145f4a21d", "value": "3072:Plpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Plo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621814500, "uuid": "e88266f6-9534-4837-9ee2-91861ae8dd1e", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621814500, "uuid": "e858dad6-f3b2-4015-a553-a318867ff5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621814500, "uuid": "fd9cc9b8-e2b3-4010-a2e8-aea98c9f2acc", "value": "addc3513_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622f8d67-bc81-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621854944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854944, "uuid": "4fc05cef-7817-4082-bddd-b361d1285836", "comment": "Malware payload (NanoCore)", "value": "c2b8d37fe3a6feda5daacd99652528e7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854944, "uuid": "71017425-e421-410c-8e70-89ef71e7d68e", "comment": "Malware payload (NanoCore)", "value": "c65d421876d3fec1bdbe5ee13415d8304249b2a41cc265b37053ca6210bfb02a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854944, "uuid": "dc980400-523d-4e79-a259-354e7294b836", "comment": "Malware payload (NanoCore)", "value": "31cb3b239629775d2b02939a90d97d68e554ba59", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854944, "uuid": "e65a472b-b8b4-4ece-b247-f4288ac1520f", "comment": "Malware payload (NanoCore)", "value": "d7d3dcf7dc33425aebf3338b4cd86e71e69baec732b7c3ed2359822256b59b3d129318780c36d36919c633e5bfcc8f9d", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854944, "uuid": "12523e5c-ea61-408e-8112-2bc2ac1afd47", "value": "65B423650FEE71ACEA3CF573E7CC17E4AC2655B071CD297820B1BD0A750D2AB06AC256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854944, "uuid": "2a4df900-0166-4a45-b6a9-d91d060ffed0", "value": "12288:09WH8m/u04MZOueLNQJfDw/VUmdk/uvchTmjc/CKth:H8cuxMZOnQJLYVTk77/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854944, "uuid": "ab0c4da1-6559-4d39-89f9-e9f73b55f5ac", "value": 536817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854944, "uuid": "bff36851-4935-4405-8e3e-452008ab449f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854944, "uuid": "9ea2f1f6-717c-4dd3-81c6-4a87f92325f3", "value": "paid invoice.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7570a951-bce7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621898785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621898785, "uuid": "ad008890-54fe-4361-a53f-a088ab6416c6", "comment": "Malware payload", "value": "3f19013da7fecca4d8516d3d40fca105", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621898785, "uuid": "78cd764f-61fe-46c5-9803-67aef5516a21", "comment": "Malware payload", "value": "c6a5c8a8e473b81c992877e2639cba2c93a776bdf2a08de077401deaae821c07", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621898785, "uuid": "dbb6142d-f0b3-4f23-bb67-64c4b45a4d38", "comment": "Malware payload", "value": "3cb32d5a09df076edb1aa260d2d469a0cf752e38", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621898785, "uuid": "27d0f653-cf4a-4f29-b9ab-83c1c8e1acb8", "comment": "Malware payload", "value": "10192898dd8d8787fb5fdee31a0120af5ca6991527f5b305e2a39b0576789f5a376ab20238d264d6d5f63eb615a16af7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621898785, "uuid": "b84b9c36-d365-4371-a30a-e61116332015", "value": "3451328C329FB08E57823B69463F0C18EEADDC31996481B8F2405ED476B973DE5994BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621898785, "uuid": "3c355ba1-f6e2-4703-a90a-77a46e9fe317", "value": "48:hMWPU8XxnOGsWYzMzZF4ivmz1YWN9qPX8M+sIrAQuPk1m7bJS1sWZj2zSP51jE:hljOgY4zZFMmo9cF+tA/M1mXJuvj22PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621898785, "uuid": "4c366ec5-6c9f-477a-bbaa-6eff7bc1b4ae", "value": 2833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621898785, "uuid": "f7211259-e8ad-421e-a9a4-2c193a17555a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621898785, "uuid": "3e97adc0-1b79-4ea3-bb71-9c1b8bac6c6f", "value": "c6a5c8a8e473b81c992877e2639cba2c93a776bdf2a08de077401deaae821c07.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318f0d79-bcac-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621873331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873331, "uuid": "c1969b77-4734-4acb-a055-6bad209f9eaa", "comment": "Malware payload (AgentTesla)", "value": "19564405739674482473e0f0c89441cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873331, "uuid": "66f58df0-a724-4e1a-92d6-b032732a4521", "comment": "Malware payload (AgentTesla)", "value": "c6aa20cfb1e01e267566a1b47ef22befcda83e4cfce36b856bc6366407fb3a49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873331, "uuid": "11796be5-7df8-496b-8b5e-922b305ee23f", "comment": "Malware payload (AgentTesla)", "value": "4e6f158df241af996514238539e177f65299e039", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621873331, "uuid": "d4f2a99c-278e-4098-9c77-40896feaaaa1", "comment": "Malware payload (AgentTesla)", "value": "f7137bbf4a40bf4d110c2a0050248cd88f5b90bc0aba973940acb1867258eb2565d775ef6468663749f3e4fc85691d93", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621873331, "uuid": "1b6aad61-590d-4f9e-afc2-c68c8926cd65", "value": "ECF4239F9BC3A4864D5152C6FC87D801B4137AA9430F5EAD7242A313D3BD1A770EB1BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621873331, "uuid": "53ecb0eb-0e0b-433f-ba4e-4d62d06b7c0e", "value": "12288:kYzh8nU9DTtznerjDI8uQ7zgtgkyiCJDKppi7BF/6YaNdRBU7p8+e0AqxwIji7yg:ko0unerjJgSkyiCJDuiahRBU7KA1OIjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621873331, "uuid": "cedb6051-8254-4140-881f-4432d2db935f", "value": 758264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621873331, "uuid": "109bb985-56c0-4285-8e70-e94918db1b44", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621873331, "uuid": "faded333-d442-41b7-87d4-bb870d8316e3", "value": "SHIPMENTS FOR INV FNT022202101 FNT054402101 FNT023302101 FNT024202101 FNT089202101.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5221fdb-bc87-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621857661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857661, "uuid": "cb61c1c4-9b8c-410c-8873-ea5d69026283", "comment": "Malware payload (Dridex)", "value": "023ab2dd59aa9f07c928806f35be0a8b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857661, "uuid": "33c6f5bb-f004-4362-b141-140589c0b46d", "comment": "Malware payload (Dridex)", "value": "c78c36ed61ddffb5f8a61542b2c26003f3fc6511824af44164213b73b42057c4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857661, "uuid": "9189fd36-2d7a-4458-b753-085b8084a12c", "comment": "Malware payload (Dridex)", "value": "8a412f2bad761e5a4d0533432a02f2e5c218a7d0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857661, "uuid": "fdeb5965-4bbb-4ade-932a-bf64c59f9985", "comment": "Malware payload (Dridex)", "value": "d4d7d3240bc15ffc578be4caa82339dc47f366e9ec16127648ce3e191ea0f077577b41b60183861212062a1791e8995a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857661, "uuid": "e53fd57a-5083-48fa-b768-febfea746717", "value": "59F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857661, "uuid": "2199c7c7-41d4-492c-80da-0d588dc3f919", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857661, "uuid": "179a15cd-415e-496d-836e-b0cffc4dbd6c", "value": "3072:mlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:mlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857661, "uuid": "0fa08f0d-7d99-4b71-ba10-b76d44a07645", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857661, "uuid": "a4ed0a70-ae69-4f4c-be60-77ebaf24a171", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857661, "uuid": "c153f3d5-bc17-4dd1-9b3f-f7658219e37c", "value": "023ab2dd_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf07a60-bc8e-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621860682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860682, "uuid": "80e9a2cb-6a24-4f7a-9061-a8238dd3fe1d", "comment": "Malware payload (SnakeKeylogger)", "value": "a927a40c57426cee9419efd51dd8578c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860682, "uuid": "85b6aca3-6a07-4157-9936-b2b73b464202", "comment": "Malware payload (SnakeKeylogger)", "value": "c7b0ffa9e13504273b2db5cbc7c6792004cbf5a0351c90a8bf4e5162f12bb54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860682, "uuid": "b5b47dab-6c27-4c18-a0fb-73af59729c84", "comment": "Malware payload (SnakeKeylogger)", "value": "0e1a1be75494d5a0408ab766d29b384c649a826c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621860682, "uuid": "cb0e482c-9782-42b0-a29d-0989cae52ffe", "comment": "Malware payload (SnakeKeylogger)", "value": "37d8f9a5ad520d0d6ac3b3743c75ccfe6c5da70a0a8bc55a1ea9dfc3bee03fa721bdb11a1167f3fdd37e29c0e5116be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860682, "uuid": "24e59870-1eac-47bb-9b75-a95c7a1b2e6f", "value": "B5056B343AFA501AF173EFAA5AE474D69A6FB6333B07A45D1091038A0723E41DDD193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860682, "uuid": "887a4035-fa6d-49c1-8ede-c93572db0cd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860682, "uuid": "379e6e61-74c7-4f3e-adb7-6ddf7b575bb2", "value": "12288:PR1IW284wQJp9fCZP22JP3cIhJuM6VqSogFoUiR1W6FUlPiVItsqPAiaYVi+dqtT:P6Xtoh167VB+1Wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621860682, "uuid": "ce556236-aa45-43ab-818b-00523e3bd5d6", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621860682, "uuid": "7df91ea6-7b56-4c68-a8d0-b1f97083b1aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621860682, "uuid": "4fa61745-27c7-4fc4-934d-bf0ba5f676df", "value": "Overdue Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99dd19e-bcc8-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621885666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885666, "uuid": "e8ebda79-f34a-40ca-8475-3066e43c3213", "comment": "Malware payload", "value": "48e050ad55861d67c51607decdd752e1", "object_relation": "md5", "Tag": [ { "name": "Anxiety", "colour": "#35D3B1", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885666, "uuid": "ca6a2f2d-55fb-4bcf-8f4b-c99fb1671f0e", "comment": "Malware payload", "value": "c829ccecac3a97fb551ef0dc2f22a9e0e72939574af0f13230c096bc39fe63d4", "object_relation": "sha256", "Tag": [ { "name": "Anxiety", "colour": "#35D3B1", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885666, "uuid": "b2a1f059-48fb-4bd6-8d47-e5a14df36738", "comment": "Malware payload", "value": "eb133081a14c1dcf13508c9f33bf4e3fca9179ed", "object_relation": "sha1", "Tag": [ { "name": "Anxiety", "colour": "#35D3B1", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621885666, "uuid": "4d939a55-e0c5-4983-84f0-92a85bcd18d4", "comment": "Malware payload", "value": "13af6a69809807375cf483f035737c8b654e7591523928ecfa21d27a7b06f78f3a6135bf9c24dd3883741afb0a7b1a69", "object_relation": "sha3-384", "Tag": [ { "name": "Anxiety", "colour": "#35D3B1", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "Win9x", "colour": "#378144", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885666, "uuid": "a5df2258-267b-47bb-a5b4-c782f30e5bc3", "value": "0723541A7255D4B1D4CD0D328E27CBB86E727E161814DB33B2B2BB5EEC70A427D2624D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885666, "uuid": "17594386-90ca-4c27-9dd3-47819f149bfd", "value": "838b4a6a04d5226ea4927e511e68d22f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885666, "uuid": "1b58cec6-f892-432a-8e32-899e3b486900", "value": "192:Vq+UFGqWzH3CJJwB8tv/PRTGzyGAVlLY7eRWt8W6h9IBcCtmS3EAm:VEFvWzH3CJJYOfhGILY7KWt8WZcEBEAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621885666, "uuid": "d624feb8-d2e5-4ea8-82e9-df985e2649a2", "value": 49736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621885666, "uuid": "79e28aec-34c6-4458-9b5a-cb3dc1fe1c40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621885666, "uuid": "c09a9d3e-3aca-43ca-b56f-51e436b452af", "value": "Virus.Win9x.Anxiety.1399.b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a95b39-bc96-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621864164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864164, "uuid": "652fe583-e867-45be-a938-2a103b712c74", "comment": "Malware payload (NanoCore)", "value": "fb5d2a2382c78967d8166a27a0912f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864164, "uuid": "86d3d138-0eee-4d9b-820e-4072940f6861", "comment": "Malware payload (NanoCore)", "value": "c85d0516eba2857a5237cd416a538b91a74fed441b3f638887ae77e3b7035656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864164, "uuid": "bcaebc56-0182-4fcd-95a0-54013e0493b4", "comment": "Malware payload (NanoCore)", "value": "a6bb1cdf09a2825ed7acc49396dc6898009db5d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864164, "uuid": "6e528c94-6320-4e07-a939-d927fa8d0f62", "comment": "Malware payload (NanoCore)", "value": "4c8fa11db39ec3b4c7d1fc6ebe9457630c7ce0a4e6ef7f589e31fe7f3b9f4da78755b9986d8dceb76791f556b139716e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864164, "uuid": "dd66962b-eca9-4bbf-9443-913087a172dc", "value": "EDD4ADAC359075DFC86BCD728DA82C64A62074BB530BD247A057169C9A0DBDBCF186F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864164, "uuid": "8d51253e-ef57-46c9-80c3-3f3a48fc524b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864164, "uuid": "2eb42335-f843-4196-a141-521bf50e53cb", "value": "12288:QQ7MbDzhXU2szi4wNhshp/xY8ntBDeLamVKjNn/zmHsr8hfsT5p36QVkF08Vmdbk:QWMbDlbEV2arx1ntBYwjNn/zmMrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864164, "uuid": "06b84cbe-c7cd-4376-983d-5e89ca16cb03", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864164, "uuid": "2aa94f0f-1007-4ff3-8853-6d47df8cfed5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864164, "uuid": "405182d7-7ba0-499c-a72b-a269eb646b0e", "value": "02_extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d7331e-bc66-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621843415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843415, "uuid": "ea43c713-f489-453e-87c8-c42af15b41c8", "comment": "Malware payload (Dridex)", "value": "71a86eab135114123dcfa4fe1a11177a", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843415, "uuid": "63c132e6-41bd-4486-8302-bc91173a4814", "comment": "Malware payload (Dridex)", "value": "c899a802187d99c08516b012b8d443859a26f805eaa6bca43fd01faa177061ed", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843415, "uuid": "eba347b7-ca20-4f15-a061-e71ecfb591e1", "comment": "Malware payload (Dridex)", "value": "393499e7ed2a1ee322cb6dfc8317e4445e25e2fa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621843415, "uuid": "5e5a6510-7adb-4078-a99a-44f488b667dd", "comment": "Malware payload (Dridex)", "value": "c1802e48c7c284a927d2e22b94548ae7f5cb36b04344d0b6ccbb4d4148f980171bf2ba164c7cff780109d2497a9cfc11", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843415, "uuid": "ab56000c-f77f-491a-9911-cf19bb9ee341", "value": "4BF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843415, "uuid": "2a521f76-0043-4acc-a14b-50b1da5cca84", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843415, "uuid": "9da72f23-e52c-4622-9ff2-b0cd7d0c1368", "value": "3072:4mNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:hLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621843415, "uuid": "8c40c024-5f3a-489e-aa57-269983c0538f", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621843415, "uuid": "f074778e-5e0c-4206-9750-300f053bed47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621843415, "uuid": "4b9032f3-c523-4363-9cf2-6d5bb6a9cb75", "value": "71a86eab_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d206733-bc6b-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1621845514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845514, "uuid": "532de739-2372-41f4-887b-eb49d76d8341", "comment": "Malware payload (SnakeKeylogger)", "value": "c93f4b31f8349d921783ae8ca80d6e37", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845514, "uuid": "c0bf6626-2c25-4b7e-ac90-58d73ba688d8", "comment": "Malware payload (SnakeKeylogger)", "value": "c9167cdffebdc1df6b5ead836a526e29164cbaf57c1b50f888950dad1773b9c2", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845514, "uuid": "5aa9b241-01e6-4df7-ae6a-e0a6efcb1c9d", "comment": "Malware payload (SnakeKeylogger)", "value": "482cadf378cb61ac9a64f32cec812721fb48b7c7", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621845514, "uuid": "93fa16ab-a158-45ae-9df9-1f52a048f4b7", "comment": "Malware payload (SnakeKeylogger)", "value": "720a52595c7fdc7e1f1f691da3766ab2a6b794c4a3ab2f314e4dd46216b1374de8fe2f7482adf17c4e644381275aba95", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845514, "uuid": "37155943-7fd4-429c-9275-1eb9c49a162b", "value": "0FA4D0AC36A0B4AFC967DE32CD741C20DA30B472532BD34B9453156D9A4EADACE116F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845514, "uuid": "f38d4d7e-236b-4f74-a0f5-f7e0ce92f3d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845514, "uuid": "1985ca09-850b-44a1-a39e-81f770d0a4a7", "value": "12288:ASH82BF6cU092eOC85ugoQWl7h0oQrFlCQX:AOPZseM5ug2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621845514, "uuid": "f6847fd3-4bb3-48e9-9db8-40e8ae505185", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621845514, "uuid": "63f2675e-30e4-44c7-bc98-f3133eb7462e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621845514, "uuid": "ab182b6b-a675-497f-aa9a-22a22b71c26d", "value": "TT Application.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb0dee2-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875690, "uuid": "669fd231-2dc3-4c32-ac49-7187f72e10cd", "comment": "Malware payload (Dridex)", "value": "074b2f47e5b2175bf539921a6a220ba2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875690, "uuid": "7bc0a30d-4f88-4c5a-bd59-bd5c192c3e1f", "comment": "Malware payload (Dridex)", "value": "c9432ddd5e7db05fe9e9c978b75ce9a6d4b98e3f9eaf32c6517e012ba4c2aaba", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875690, "uuid": "ff3ca4c8-54d9-4ade-a210-cc3b9635bc30", "comment": "Malware payload (Dridex)", "value": "75659edbedb840bc2e8f1d9dab868533e9eb0c3e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875690, "uuid": "4412bb47-2d5c-478c-9e8a-74290c8f2977", "comment": "Malware payload (Dridex)", "value": "c77c1c587f0f8337a62bbf384c6a25d98a90623af68225e2c753c604fe829f1917979633503359da0c150eb6e1fa781d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875690, "uuid": "06bdf369-2567-420f-bf64-4d54359e1df8", "value": "60F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875690, "uuid": "f692a702-5ef8-44fc-97f2-75235f55d5d8", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875690, "uuid": "49dc9277-b1fe-41ae-baac-8de8b0aa8607", "value": "3072:vmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:uLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875690, "uuid": "1cfa8a65-ed73-40f7-a537-b0236862a087", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875690, "uuid": "2d7cd136-db5a-416e-bdfa-e235ea537fc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875690, "uuid": "bda26fde-10e1-48dc-bd33-45ed923841c8", "value": "074b2f47_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f8f631-bc86-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621857100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857100, "uuid": "52a38352-9c6d-49b4-bf90-5ea851b630ce", "comment": "Malware payload (AgentTesla)", "value": "d877cea12b96e67b115c7acaf9516329", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857100, "uuid": "bdf5182c-70fc-40ba-8f5d-7c23a5b2c675", "comment": "Malware payload (AgentTesla)", "value": "c94cc9b7cdd7d427ec608a607b8fe4515eba0479422b02b7008c3973ebc1dcf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857100, "uuid": "dd894fa5-eece-4a31-a07e-40e1b76aaf3e", "comment": "Malware payload (AgentTesla)", "value": "7f55c0d82218eed528a694531a308f660ff70073", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621857100, "uuid": "2e9fae6a-d1ec-47bb-ad1a-972e8f9e7fc4", "comment": "Malware payload (AgentTesla)", "value": "59921a6fcd50f71d7792cb5e429a1ec103ff86384af9ff1814643a104040bbc917c09ff7f0411be17bc508879f2c7381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857100, "uuid": "0af8f17f-e24d-4e14-9f76-b49bf506aaeb", "value": "BAC4E0233398AB65E1FDA7B51020551013F2B59AEB26CA4C3ED810DD6576FC5CBB2B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857100, "uuid": "953bb799-f733-4e1c-bdeb-60c118deeac2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857100, "uuid": "1d5da87d-5249-4ff5-9464-77866f680583", "value": "12288:Ka2BHUMebRL3Z/XbbgK6ACF2AL+HJdwgl+S8H08I4Pow+azGM0ToU4qkiYf03sUr:DIp3A4zjRzoekcIdZuNoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621857100, "uuid": "df5c1c8c-6b0f-40a7-9a39-e4b3b9befbbe", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621857100, "uuid": "1845fc81-939b-42aa-8fc5-3af51fb14a42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621857100, "uuid": "6f3de744-d1f6-4c9a-9d33-3891ae0f03cf", "value": "PDF#Purchase order22435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7955c6ce-bc2b-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621818047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818047, "uuid": "1a37b93a-7d12-4251-8156-9e63a3b4d54a", "comment": "Malware payload (Dridex)", "value": "33594190f7ffbeabea6178b15c757945", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818047, "uuid": "14dc9a11-b9cd-4532-9674-c496c077691e", "comment": "Malware payload (Dridex)", "value": "c9d71bce6327cbf3fc649afad162ebe70adc3cbb7a6f2801565869e4b7973fb5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818047, "uuid": "3702aa24-a049-4ff8-b5dd-c24d669618d9", "comment": "Malware payload (Dridex)", "value": "6694c4500b1031d9c067a2ab57d3613f36c11e73", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621818047, "uuid": "6198256b-f2bd-4d8f-8cf0-f797578e022f", "comment": "Malware payload (Dridex)", "value": "b280d2b0c415ebb0e917264a34e1415abf8b06fdc2793c88690fccd5d92a2a585eac63ff91199a20f21dc52ad9ab543f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818047, "uuid": "74aa566c-01f1-4b24-b85a-e01c99aaeab1", "value": "7FF3D088CBB3E4E6EFB3D37866F85E1B561174551408F4F0C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818047, "uuid": "bcb04a68-f59e-494e-8475-a89892ffa842", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818047, "uuid": "1f075f0c-3fd4-4422-806c-ecdd429ecc79", "value": "3072:LmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:aLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621818047, "uuid": "1d9f170b-9dac-4552-a9c9-79b0083f814a", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621818047, "uuid": "d734c47b-9108-4dda-b99c-f1d80637287f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621818047, "uuid": "cedc72bf-80cc-48ba-bcff-9463041e7eb5", "value": "33594190_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9517024-bc76-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850393, "uuid": "c4c7ff9d-1d28-4f85-abc4-036226f83615", "comment": "Malware payload (AgentTesla)", "value": "f12befbca264bd4461fd9b6753f319eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850393, "uuid": "3480ca7e-0a59-4a5c-97a2-6fbd04e325e0", "comment": "Malware payload (AgentTesla)", "value": "c9fbab3d9881853c8fd0c487429700a945c0d458f46f696662765dec18b3dbfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850393, "uuid": "c487a4d7-2dff-41ea-96d0-150de98a8621", "comment": "Malware payload (AgentTesla)", "value": "999e1a0319e42c17b5dc6cdb5445d00263a2509d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850393, "uuid": "dc056b55-38c4-416a-8ce8-aeae79cd438f", "comment": "Malware payload (AgentTesla)", "value": "4cfd7b28aaefaeb6cc1f65c024e88e46c7d856230cd2386994c25c9e191dbda927f63731bf12077a37039d51eec24697", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850393, "uuid": "7447aa0e-3be5-4642-a40c-5a2a781384cd", "value": "2BC4E03663894B69D53D67364161120013F8E89BDB33DB5DBDBE50ED262AE044BB3B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850393, "uuid": "a065961d-bed3-4381-8281-bf94294919a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850393, "uuid": "4dd7908a-8f0a-40ba-8068-3e9d4b931bc6", "value": "12288:DnP2oF3UpIRSgCQ8bFX5nLh+iIliaKCZphKz:TzFkeBX8bznd+ZkhC78z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850393, "uuid": "fccfe8be-f7ea-4e30-80ad-169c47209ed5", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850393, "uuid": "e6b112ad-5ac3-4160-a05d-401a480af12f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850393, "uuid": "5ae25cbf-7322-43af-95cf-b9c2b7231fb4", "value": "Email Copy - HAWB No_ PSGA00688171.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ca2593d-bcaa-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621872544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872544, "uuid": "bea1a5b6-71f0-4016-885e-af8006f91ea5", "comment": "Malware payload", "value": "8e59dbf5d74d76bd1546fd7f325233cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872544, "uuid": "626bc06e-598f-419e-9049-9563d71a4a20", "comment": "Malware payload", "value": "ca31eb3be026724fc6901cfa082e446e935ebb0ee1d6364fc7bf4ecae081a934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872544, "uuid": "a81f4163-a4e7-4158-804b-ac377d34f954", "comment": "Malware payload", "value": "b944d57a36a33b09442fddbd3f079fabe9d9f0b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872544, "uuid": "f44837b2-497b-4555-8f7b-da5d8d4c4cba", "comment": "Malware payload", "value": "b9aa7b7c098c2f763f681fa05572637b438aab67f3816aec461006a900fa3ca4caea2f2c1696d1c10c7094ed23c4befc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872544, "uuid": "9c4e9a22-0f15-404c-aed4-a8584af535ff", "value": "DD640D4472FA2F86F4799BF812A35020C7F66A2A286EC75F9DC375D72672F044A20D53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872544, "uuid": "8951e8fb-1a0d-440e-a838-841478c1cf15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872544, "uuid": "927ac695-0621-456d-94ab-c2fd0aed4fbf", "value": "3072:AJV1LtMXKSk7QIzH5bssgaeFkT2tAxnQ3+HzYvh6TQtvdJG0ZBdEor1jNAGOwA8L:AJ+CXVqkIAxamc6TGPBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872544, "uuid": "b3c02a42-2a94-460b-bce8-4c048715471d", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872544, "uuid": "fe28a048-10fc-4485-9106-ad64dfb5e7c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872544, "uuid": "c8480997-1816-4b47-9518-1e8dc9679186", "value": "TT99080000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72065ac-bca9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "ae9d8877-fdef-41f1-820e-5fd39cd37c1e", "comment": "Malware payload (AgentTesla)", "value": "3d9a120a83e330ab0f26454a46b9e1e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "987fc00a-2353-49ea-b1e8-eca675e28fc9", "comment": "Malware payload (AgentTesla)", "value": "ca497b22a95e66b8aeb6707af677d0cec5e8eeb2a748cc52827a92ac8241ba98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "676cfe56-ec25-4cda-998a-091a9aca3435", "comment": "Malware payload (AgentTesla)", "value": "c5a9085311f2154f4e35ca68691c2f346bfc38c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872240, "uuid": "4530c01c-9e04-4d4f-9986-1e9a4abc1535", "comment": "Malware payload (AgentTesla)", "value": "557971fadc2c87ac04d4a2bbb03630a4068e921c88df05491756b91b6ec6ccce5981cea120d5680ee85bb56a41c2935a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "46169ffd-df45-48e2-b886-9477e2bb4ad8", "value": "FF15D0AC329875DEC57BD279DA680C68EBF17077930BD10BA12710AD994C9C7EF205B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "b5bbf98c-0d1a-4317-8eec-ba0c7088c4e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "23df66a1-6f3c-4efd-a08b-70206ebe1e60", "value": "24576:AEzzM4vFw1+CKhJ1mAB+dTSW9uUmB1CoEH:zzHCq25UW9uxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872240, "uuid": "c8293861-4124-41ef-8108-2603f431f3f9", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872240, "uuid": "4507a33c-97b8-497b-9f49-45da21d90eb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872240, "uuid": "759e0deb-bedb-43a7-9389-84cb43c846fd", "value": "3d9a120a83e330ab0f26454a46b9e1e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b90b590-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872892, "uuid": "5fd56b7d-bff5-4c4d-93cd-bebd2d34c25b", "comment": "Malware payload (AgentTesla)", "value": "8a30bdcd183dc4d3f79518de5b3b5932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872892, "uuid": "46aeec8d-675d-42ad-a906-2f0320213a57", "comment": "Malware payload (AgentTesla)", "value": "ca5bf1a6c94417ce81dd3d605748406ef97e5ad47c26b36e55f0e2b9dd4a56e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872892, "uuid": "1831c304-5450-4205-a706-6044580cc60e", "comment": "Malware payload (AgentTesla)", "value": "f64fd9a657b408ee84222b7c90b69a2c5f0275b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872892, "uuid": "2a8e5df4-a205-4499-80ac-12e72aa7dc06", "comment": "Malware payload (AgentTesla)", "value": "60277d3d84dd4b4763a20d2abce02c0f67cccd8955d2a72a2aff58baf0410ffab19b194e203b5d2bab47ef7f1d212028", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872892, "uuid": "a5f4397a-c1dc-4ee8-b77b-997b4b1a04e2", "value": "7A45CF027ECEEC61DCF286BD0CD59F72DD2E78EA052445BA72C8B62D15307606ED861B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872892, "uuid": "9177b89b-92cf-423d-9113-e8a897b171b0", "value": "c127345c03c7eb109783c6cc61e16834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872892, "uuid": "d994aa61-f484-470b-aebc-b6a107d1bd9b", "value": "24576:l9qFtB/zRTU05qX7mcfWTEHGgZyRBPnSLXf6pNKKAHS:M/dTI2eZybnSjfSNKdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872892, "uuid": "fa4a9da2-b5ce-4b6f-abf2-a00d218faa9a", "value": 1223893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872892, "uuid": "f20b51d9-6963-49a2-bcbe-781cc590ba4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872892, "uuid": "420de093-c07e-4905-8dee-dddd89e8adf7", "value": "INV-257591_77134027.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9507e02e-bc98-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621864908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864908, "uuid": "e7e7f57e-f713-4430-b739-b516e3dce1c3", "comment": "Malware payload (Dridex)", "value": "b8cfdfc24f59f75f8e5ca4e6d0fcb0db", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864908, "uuid": "74e47e2a-4afa-49a4-85aa-46395e6e746c", "comment": "Malware payload (Dridex)", "value": "ca6591ae350ac12f10c0ac79df6cf0fdf41b4a510a2ded4e01371cc4028b1b41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864908, "uuid": "83f166f3-37e9-46e6-84de-a2ea3a845e8f", "comment": "Malware payload (Dridex)", "value": "e413e18f2460f8b6dcc6ecd11fe5611c8af3cbdf", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621864908, "uuid": "f61bee63-e4fb-4509-a6a2-8ed19f712630", "comment": "Malware payload (Dridex)", "value": "25bd6471466075504239276529ae9f8fb74a8862ceca8bec842e358815fbb22a431f38879bb59e093700cb0832d7c0b8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864908, "uuid": "578926d5-8d3b-420f-a94c-d42e1f63d94d", "value": "56F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864908, "uuid": "54afe61c-d32a-4dbe-8c48-15951b5d178f", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864908, "uuid": "1826adac-dca1-4f49-acc9-cd49d4e9cf56", "value": "3072:BmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:wLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621864908, "uuid": "446b6252-3423-4812-9c1f-0f5158292f86", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621864908, "uuid": "4423c10a-2b74-4876-b126-a0e687151b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621864908, "uuid": "958edba5-8a5f-44fd-a071-ffe59388716c", "value": "b8cfdfc2_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9670f4-bc33-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621821649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821649, "uuid": "1702ab0f-b03c-415c-8bcc-f525ed5db267", "comment": "Malware payload (Dridex)", "value": "f9dec9fa8e73452ea3264740466ff228", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821649, "uuid": "b7563047-8f46-4bab-8259-27770c6f22f5", "comment": "Malware payload (Dridex)", "value": "ca6ec77b4c0d3817daeeb8b98145efe03d81648f82a9baa2ebdfee9f9e4a4213", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821649, "uuid": "7d2d9a8a-627e-45c3-bda2-479e034d321e", "comment": "Malware payload (Dridex)", "value": "85a4b3cb5c105481f22b2fef7b8b06cf700acb59", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621821649, "uuid": "28bca784-38bd-4c1d-8614-a0d84533edc2", "comment": "Malware payload (Dridex)", "value": "c5f7f56f4ae3deecfbb7f1f7017da5889b2df10e3d47174b30a2a704b8233cfaefd802aecfab0d68151898f3e2647929", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821649, "uuid": "b2853999-e08c-40c5-ad43-20ae0cda6c3d", "value": "97F3DFF6DAEFC282D72F4C7CA57BC273692B792D9507C6B3D5860A8FC61320511C22A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821649, "uuid": "379dbf77-5df7-4027-8ce5-f67f35260892", "value": "d20e8b584b1e294911b88a699c987910", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821649, "uuid": "0bc4bcd7-7cd8-44d8-affa-265ee9709cf4", "value": "3072:Tlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Tlo0gw4ZMypZp45g51aXotOxwVeXm7Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621821649, "uuid": "3fc1b3b4-4a96-4448-b474-3d14c3c2cc24", "value": 165376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621821649, "uuid": "412db62f-2316-4af5-a724-953c8c360275", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621821649, "uuid": "283f0e3d-df07-45cd-8922-cb14c55a50b1", "value": "f9dec9fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2888cfc4-bc77-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621850553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850553, "uuid": "72dfbc38-334b-43eb-a713-4a54dee8ff0c", "comment": "Malware payload (AgentTesla)", "value": "70622a9d433cf1222ec0f1cfbd105e17", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850553, "uuid": "a166ac89-87c4-4372-8ef4-d5d901c02ae7", "comment": "Malware payload (AgentTesla)", "value": "ca7d5eab5da4fcebcd14c42582e61abc32a055ca65780fe83e4866b5c96b12f1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850553, "uuid": "27e702ec-a719-4291-a8ed-83422a2e2e65", "comment": "Malware payload (AgentTesla)", "value": "4c2b4365762db913631faeda9536594e8331d0ff", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621850553, "uuid": "5f80ce40-4023-4b40-9259-0b9a8bdaeaeb", "comment": "Malware payload (AgentTesla)", "value": "c1b7be70942d226916f984e31f8e06d29d69755f156ffdb10538428438e9f102089f40ef098567f2bc4c97b1d45e576b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850553, "uuid": "183fbccd-5b5d-4048-b286-164ce6567b78", "value": "7EA4239C8E177B1DC6C1C32CF924475252C018E0FE9829A8D2BDD0EA2D918F67DBE5D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850553, "uuid": "24568943-02c5-4edd-8bc7-5c378ea2d3fb", "value": "12288:DgqO2WKUuK+Z7PAzz4JVf0sZ6IPy6bJ6WXOw4Fpo6EkP:Dgt2NUL+1AwXfPZ6I16Wew4I6EkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621850553, "uuid": "c4b7c502-d00e-4dbc-a2af-23272a77a387", "value": 459128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621850553, "uuid": "89572758-d309-4e51-91a5-c570baa4220b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621850553, "uuid": "667298c6-1170-4b0b-ad8c-7dd1ace9fde9", "value": "Shipping Docs_222738.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78850d21-bc59-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1621837802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837802, "uuid": "05455924-4a33-4c82-9fa8-7945bf958cd5", "comment": "Malware payload (TeamBot)", "value": "67dbd9b7f0bcd704017f3931fa51c715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837802, "uuid": "7d118f82-806e-4301-85b1-1d335a90d076", "comment": "Malware payload (TeamBot)", "value": "ca81501a843554d574be590be9f5ec0c6560679c5b1e5b4e44a879f1c9be7351", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837802, "uuid": "5fbc20b3-8f46-49bd-94c8-4b83bd8bae4e", "comment": "Malware payload (TeamBot)", "value": "46ef7f2b73c60513a93d237813deb0f210f91377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621837802, "uuid": "66a4a71a-21c5-4040-856a-631dd2f97ba0", "comment": "Malware payload (TeamBot)", "value": "442008607e46cff460611397396096c89ac40f939e8fee04fa30894551ed28d51cedf9bee75ab342f9e02e90f120dd67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837802, "uuid": "6945931d-cc6c-4f28-b1b2-3821894ec2bb", "value": "9E0501B166B0C03DF4BF16F449B482B865297DA1A72080FF62C53ADA56305E59CF878F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837802, "uuid": "0f688793-1de8-40a6-ac3f-5f6a81a75208", "value": "40bba328aeeb86af0602a23d2610bb0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837802, "uuid": "1d89bcd6-c0f4-4abd-816e-dcdd635ccbbc", "value": "12288:8WF+e+BCphvKlObytvmh84JplXTgHod/NITs5fvwMoXxrUa93tF8xIO1gRdYpnzb:2eRvrb6y8KDsgKBrdtCxr1gRdYYXsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621837802, "uuid": "d53eddd0-83ed-4dcf-b706-d6f35305f93a", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621837802, "uuid": "01acfebb-8871-447f-9e53-eb9854c0b049", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621837802, "uuid": "7fc7b84c-09c7-4fd3-8055-4a8328214ea3", "value": "67dbd9b7f0bcd704017f3931fa51c715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b73092c-bcc5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1621884085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884085, "uuid": "627c5d68-150c-4e76-8960-d41e44171562", "comment": "Malware payload (Formbook)", "value": "0e8070106cc3814164f6ac7983449b71", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884085, "uuid": "75b98e57-18ab-40d8-a2d0-ddbd21b8b73c", "comment": "Malware payload (Formbook)", "value": "cac668b50ea54195a30a9a5bfb64ff95fcc22db46c6f3c993581911c332cfbea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884085, "uuid": "b8808b40-c7b0-4057-896c-de7a2a859513", "comment": "Malware payload (Formbook)", "value": "500c07317904e653f8b3d6bf9f5cee458a538646", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621884085, "uuid": "181805ab-dbb0-4a0d-ad25-7c38d00a9c03", "comment": "Malware payload (Formbook)", "value": "210afa61ff4cd8c95e841f1653ea7eec07f3890625639453581fd614317a871cdc90ddd430e1accdbf204c3ade5cd4ac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884085, "uuid": "3409be68-3b0c-4576-8f5b-b0a614c75468", "value": "B435AE2C212AF166C2A8C2794AC5953BE951DF7774307D1AECD73B8C6B39E41788213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884085, "uuid": "ed9accde-2aac-48db-810b-f8b9bf5f3e04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884085, "uuid": "02bffcb6-e080-40b8-bdd8-68570b583feb", "value": "24576:kZjvvbGX5ed1KWOrZl/BnbJHiiOPxBvLe:CvbGXE839hX+vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621884085, "uuid": "5fd343bc-6f88-4c4f-883d-4971a5a36336", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621884085, "uuid": "78488ff3-ff44-4874-8e96-be3387abffe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621884085, "uuid": "4cc263f9-67dc-4c7e-b400-d5e00e66f86a", "value": "Swift Copy4312.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd54ab7d-bc90-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621861567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861567, "uuid": "f695521a-9bad-4c14-9cbb-ef4b608e3525", "comment": "Malware payload (AgentTesla)", "value": "3f9752685d701842e1cd47e9757d74c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861567, "uuid": "99a85c64-3f9e-4bbe-bd0a-f15d1c649205", "comment": "Malware payload (AgentTesla)", "value": "caf75f7fb5dd554c31a6b2ef46e3899b3803dcbf65a52919eb4799697692a4a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861567, "uuid": "79a87ec7-0ab7-4a90-b88d-4c0e30ad39d5", "comment": "Malware payload (AgentTesla)", "value": "fc2913cd0207d9ac92093cc88cca70480adf4d14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621861567, "uuid": "4ba6adb9-cd54-4c42-a5da-155d94cf49ac", "comment": "Malware payload (AgentTesla)", "value": "3f62963a2eae22fd0b9503675f832498d933c29c0ac5529381762da5d2e5e1d94726a1d620736a2ad7d854fde4b00fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861567, "uuid": "9dd4f295-1d55-41d1-ae77-e460028613c5", "value": "F425AE2C516EF226C1ADC2794AC4803BE590D7373132FE25ECD757A95728E81BD8227E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861567, "uuid": "3f34b85d-f322-4ee7-a6f1-c5e66eb8100d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861567, "uuid": "c04a10ef-be48-4f37-9292-3203745c5465", "value": "24576:wBCAy+Va44Tb5wn5WT3dTJ9UrahR/8BNa8Xr:wBCAyjSIRTvUra8BNb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621861567, "uuid": "9101bce9-f876-49a2-a552-60d433a85cfb", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621861567, "uuid": "f2d28631-3ba0-4fc7-9845-b55294307278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621861567, "uuid": "3a68eea8-e0b1-4d3c-b085-1ea24223dd14", "value": "SecuriteInfo.com.Scr.Malcodegdn30.23718.16147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aace7062-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875682, "uuid": "100823b3-b83b-42a1-a490-88d7d76b3587", "comment": "Malware payload (Dridex)", "value": "dec39fa86347b094185c3b460bc6059b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875682, "uuid": "326d4217-3b77-4656-98f5-ab5d13099b14", "comment": "Malware payload (Dridex)", "value": "caf96994eb625bcd2f1ff31de5eaa9bb8b3a710da773101bcce0d6d7b59015ee", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875682, "uuid": "0a4c1925-bbd8-4575-9060-751dbc9d0193", "comment": "Malware payload (Dridex)", "value": "f6acf058ea501dc00cdbb7c81a3fd1915cccfb5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875682, "uuid": "686471c2-45e8-4ca1-9aa8-bd0dc25bd090", "comment": "Malware payload (Dridex)", "value": "a60ad510ca676a8b9d499155d7b9b3f866e471d1e58ef52acf106e7c11ddcdc73a2131c95864066a1cfd0b7c3bccbac2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875682, "uuid": "afed87aa-21bf-4989-9760-a53cb0b9c1b6", "value": "A6F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875682, "uuid": "b00a5114-df3f-459c-9d50-1cc812035c73", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875682, "uuid": "98f5b05b-a152-4405-8024-2df7c8f57213", "value": "3072:RmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:gLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875682, "uuid": "4b842749-f7f2-4e18-ad39-5bf774d1b362", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875682, "uuid": "92db0f58-3e73-455a-ab0c-c2983e72e188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875682, "uuid": "6008e661-636a-4e84-8b4a-4c151907b9a4", "value": "dec39fa8_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8298435e-bc7f-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621854140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854140, "uuid": "2dbc5646-2290-4259-965c-cb0fe93bf2e6", "comment": "Malware payload (Dridex)", "value": "19c0a8a10433e2d4342a0adca788d337", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854140, "uuid": "ef12db49-e250-490d-aa7b-cb487e943923", "comment": "Malware payload (Dridex)", "value": "cb27f31b71530bbe9bb7892a52d73fbaaca2464b8b625866171d050b69c3c0d5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854140, "uuid": "0f08f93d-99b2-422d-bdb8-b8dcb7e98836", "comment": "Malware payload (Dridex)", "value": "57dd7f49e8445068769adc12cc1fa53ddc349f01", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854140, "uuid": "14b381f3-ba69-45d9-a8f0-fde4909f051b", "comment": "Malware payload (Dridex)", "value": "676b6ecba810de17b4791cff158303bba513825217896791580332153abdec81690dc6def6e7a734eeea14e7ee71049f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854140, "uuid": "ff14db31-c835-437b-a134-daf358a4ba69", "value": "9DF3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854140, "uuid": "f6c7d0c5-c29d-4dbb-9b00-b8e33a5d1f24", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854140, "uuid": "0a34f1d7-068a-409e-a2be-483c46d5f408", "value": "3072:XmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:2Lc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854140, "uuid": "6652d884-38b2-44f0-94fe-9d005895c07e", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854140, "uuid": "db8871b5-d9bf-474b-bd97-c01dba3b790a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854140, "uuid": "c50e9119-f1dd-4f90-a74c-a7c827ee61b3", "value": "19c0a8a1_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa7c2f01-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621836168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "ee152228-367f-4edf-b347-0dc1ab605e38", "comment": "Malware payload (Dridex)", "value": "3edab7fab52df5150060f7d0b0358fe8", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "4f731ece-ce55-4183-a835-176466cad988", "comment": "Malware payload (Dridex)", "value": "cb55643a831e48324e2290b17b25728a0c75496349516017e0008f94d62acf5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "b9082ea9-8911-4069-b51a-3efe75fbac7c", "comment": "Malware payload (Dridex)", "value": "d450b801fbbdeda849b8d39e2eaf2ae07bebf839", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836168, "uuid": "679b54a7-468a-4400-92f4-48d60372fcc5", "comment": "Malware payload (Dridex)", "value": "4f2367a2bd71c5c602ad4a68076f867f926a958ad2cf8ec691c45b93ed8e2495a1a36a1fb9de2eb084b93b46f7a117ca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "60dbe1f3-3964-4a93-80f0-0d62a07e34fc", "value": "A7F3D088CBB3E4E6EFB3D37966F85E1B461574551408F4F4C86CA68FA4ABD008AE50F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "756d8427-4ca7-49f0-b2bb-a0ef3d9d8b26", "value": "987b9d7dc84d935c3675da82d40e06f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "b5537f22-950f-42fe-9c7b-ccae35dd0675", "value": "3072:imNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:zLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836168, "uuid": "5511e5e2-c276-4642-968c-08e7b26a2a73", "value": 165888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836168, "uuid": "6939dc88-ede8-436b-bac2-8e4a9a283709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836168, "uuid": "69a74626-b616-4dc4-bcba-845749175719", "value": "3edab7fa_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5311c9da-bcab-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621872958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872958, "uuid": "88077a0b-ad72-4acd-9622-86796d115125", "comment": "Malware payload (AgentTesla)", "value": "3f71b4e09f7bd3e1ec91afb59576ff0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872958, "uuid": "9418cac8-98ea-4d17-814c-f0e8aae3bef8", "comment": "Malware payload (AgentTesla)", "value": "cb652ce9ba3314008970f32989b733e722abd73adb12064a952ecd12388a868e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872958, "uuid": "089c8007-9dbd-4ce3-bc90-9c8537c0cc76", "comment": "Malware payload (AgentTesla)", "value": "f9d079ea86605c91a483aa26261f0989a2573b06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621872958, "uuid": "b04cff00-8b90-4de0-8979-12a8af9ca71e", "comment": "Malware payload (AgentTesla)", "value": "0bc3a7e2b832d9fe7c7b39882841dc8aa1627123ba025563bbbf73c1668e129d14bc2249e184af2296db07ba578ace30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872958, "uuid": "c54eb556-15ca-4ab5-b97a-9a7067c23d4c", "value": "4825272C116AF132C1E9C27946C4442BE751D73F6032AD25A8F7DF98763BE40B98D26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872958, "uuid": "a3505bb0-c3a5-476d-9d78-887d623ef5f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872958, "uuid": "2cbef7ba-e94f-4b29-86e1-4316710d99ad", "value": "24576:xVokBCBtvBL5hY4oQv/qi9+AYJtAo0Qa1:3BCB7bgy/lZAtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621872958, "uuid": "ce064ce1-7f01-465e-a6af-de6e6039653a", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621872958, "uuid": "2c52847d-ba36-4afc-ac79-d0520a7adcfa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621872958, "uuid": "07919932-7404-4769-bb9c-ad85aab1d87b", "value": "WEB2020 Catalog and Professional Export Priclist Cono Group.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6fc90c-bc80-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621854587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854587, "uuid": "38b2ed05-24f2-4a5b-b896-ba55b029114a", "comment": "Malware payload (NanoCore)", "value": "ee26d5d717f9e9b535504ff9989d890e", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854587, "uuid": "4d3ed7bd-14a1-46a5-8e80-e9858ec8a424", "comment": "Malware payload (NanoCore)", "value": "cbc87d70317d1e6ae7b31e7b04aaf4d4f3657fa547366b39bc8553d8e25544a6", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854587, "uuid": "58f2c079-bd83-43e0-87fc-2c465d7b29c0", "comment": "Malware payload (NanoCore)", "value": "08b50163657dade17de9c2656e4b466cc65264dd", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621854587, "uuid": "9fcfc562-ab57-4f41-b6be-9382bd7b52cd", "comment": "Malware payload (NanoCore)", "value": "f25cced8ee37b2b0b659f0030e2200f224275f63622e7a1782e16828d0d79270941a57f61063e065f5d5e3af97f532f8", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854587, "uuid": "e4f8d93d-b935-4a84-aaba-ec851324c25e", "value": "C155333EF2A6CBE0589F6426FF8803F9F505B9447810C90FAF9538E5C5E7B68864E464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854587, "uuid": "3d3f5a74-78f3-40e8-b556-24a855eee142", "value": "24576:5LevlHkPJEB+DHDa3actpQbZteDJj2pBdFni3yxzYM7nKR5HRjKNHd6cL:5LUHkP2BeaqctCGJjerFni2zYMo5HRj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621854587, "uuid": "720364d1-8bb8-4d11-b34b-f884f620a76b", "value": 1384334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621854587, "uuid": "7dac58c7-9644-41b8-963f-3129c393d7c2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621854587, "uuid": "d7a74869-8b16-4cf7-9b91-2f6665d8fa06", "value": "MV OLYMPIC VSL PARTICULARS & MASTERS INSTRUCTIONS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a247b7e7-bc56-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1621836584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836584, "uuid": "385bb608-c5fc-4ab2-a9c1-8bd9d75e83bd", "comment": "Malware payload (AgentTesla)", "value": "b2f7064c104150491de74bb2cc6c7b36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836584, "uuid": "5cc02af3-7615-40dc-98c9-aac473f6e302", "comment": "Malware payload (AgentTesla)", "value": "cbc8da9fd827ff80d54955b350c52f26df5a5b6edb103a7d619a7d3cbc07cb44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836584, "uuid": "6e9863c0-c2a8-46bc-a285-8b495bb16565", "comment": "Malware payload (AgentTesla)", "value": "4fd30907c03c8f5c7d88bee3c8f1073776af9f1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836584, "uuid": "d688f1ff-2cad-48b6-b7ba-d6f835401255", "comment": "Malware payload (AgentTesla)", "value": "640228f9214182e3e7234067537c9d9e91f240849bb62e3acb771ad0a5e474da3e755580fdb0271b4ed557e8f9e1d7bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836584, "uuid": "e88da6f1-1b1c-4e59-a70f-69102dab60d6", "value": "23E4232BE31B6B3FBA96A384F07C72605585EBB270AEEC0F4D51BF586B99501460478C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836584, "uuid": "ec830c48-4eae-4f35-9a46-625e16f2640b", "value": "12288:jOtfMkqDV2Tz1s77lcuKXb7lnBc1fTqjz+xj81KAzSh3fV34G/rrAXV3o7Y:jOKkq52f6/lc1LRnBc1fWOxA1KAepd3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836584, "uuid": "11b527e2-d78b-46a2-b83b-4c22563e9304", "value": 715578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836584, "uuid": "4a8263a8-8c46-4292-8c91-b3be1d9b66a9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836584, "uuid": "2b0e4e95-f80e-413d-af53-089b2c0bec5f", "value": "Email Copy - HAWB No_ PSGA00688171.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cf3d6f-bcdb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621893708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893708, "uuid": "6fb739fc-967f-4da9-98a6-006a11e9af88", "comment": "Malware payload", "value": "d54fdb3ccb2b7662e5382168dcc18a85", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893708, "uuid": "3f060eae-1b64-43ab-8f40-d99f5f8dafb3", "comment": "Malware payload", "value": "cbcd59ff965db7bfc95dca17b76bb93151a454e7507262b44e3d4e79e710d1df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893708, "uuid": "847f919f-6f68-41bb-b8a0-e1344b6b9268", "comment": "Malware payload", "value": "4ec2635a600aa293bf29fc04b226523415afaf8c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621893708, "uuid": "ea560313-1191-42d0-8fe2-2881315a3d7e", "comment": "Malware payload", "value": "daf61d275ec9966526a3711ed38706ee97bd4cd73b3e3e1b75a37816e0697b9285ca3f681d3a7678b010d9daba4e7884", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893708, "uuid": "caace03a-399e-4567-add7-f394354055b8", "value": "37F3E00AED9FE988E85C51F1CA4D363EE9713E371B5BDD08C584AE9DC24B252A4F0352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893708, "uuid": "04e34ba0-64b0-4ef9-baf2-6053175babc7", "value": "f71b9cb9891e9cf4bae79d2b5aa115c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893708, "uuid": "ba3d055c-0fff-4921-98e4-0cb65eb12599", "value": "3072:yiFieJeVDC5PIh/31VeSDH2jW+zsKWncDlRe0PLDt:xeAU/TeSH26cs+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621893708, "uuid": "62892546-5fc3-4904-bb34-76b4f2eaf010", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621893708, "uuid": "cbde7d25-0b23-4966-9f66-ee5c416f6be6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621893708, "uuid": "c748c3a0-02f9-4e95-b771-2c7a9ce58b83", "value": "d54fdb3c_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23eee5bf-bca7-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621871161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871161, "uuid": "2e4bc39c-e3e6-4e95-ae04-1eb89b9741c0", "comment": "Malware payload", "value": "55891b061770009f0040a2d6376f7c9e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871161, "uuid": "dae98ff3-1344-49c7-8edd-8289dda0713d", "comment": "Malware payload", "value": "cc1c5a09d0028693198b1eb31364b8a09ca66e9ba383f98411ec08a229daad64", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871161, "uuid": "f62d47af-e0cc-4e5a-bd8b-67dd8591bdaa", "comment": "Malware payload", "value": "702c35b79e22d33ce8fe48263122023921941800", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621871161, "uuid": "2d7ab666-ad8e-4810-90b0-5af3d401af04", "comment": "Malware payload", "value": "2a48e50112ed89fbf5b8da0b382e42f59cd3dd61184548829d602b16a4baef5588fc66f6af711c1786d411922a4e5012", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871161, "uuid": "4740aa7a-08f7-4e3d-ae18-240635e80861", "value": "BE15C59C326071DEC46BCD768AA82CA4EA60347B5B1FC207901715EE9A1DB97CF146F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871161, "uuid": "033198b9-ef31-4813-9d61-479313328ee1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871161, "uuid": "e3fb6696-1eb0-4d90-a244-9da94a7d21a2", "value": "12288:L1XQdQJrjmU3X6PVaiA8wudHxF3FQy1G13xwdRMvEX93OFDtEe3sDHQE40sIUwl6:R/RH6PVaF8wudZQyk13k2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621871161, "uuid": "6163d925-c4d3-42da-b34a-458ff7271d03", "value": 957952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621871161, "uuid": "8ca91b4d-d1ca-4b10-a9c6-bf0791727d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621871161, "uuid": "561daa96-0b1a-453b-9628-0c92905e9c08", "value": "DHL Shipment INST_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bd1f9a-bcb1-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1621875746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875746, "uuid": "c81025b1-a6c0-4885-be10-7338c2a7b165", "comment": "Malware payload (Dridex)", "value": "cced650b6d2185f909ac1212c3029fb7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875746, "uuid": "59a99d07-98b1-4c41-8009-0db8fff4f990", "comment": "Malware payload (Dridex)", "value": "ccfebde1f87cf4a6de36a1c13c6119a56d30d6e01d88c72699156dc967dbde89", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875746, "uuid": "dd2af0fc-aeae-45a3-80ef-57d44b1f3255", "comment": "Malware payload (Dridex)", "value": "53d724200ec10fd33c66c56b68e319d7e0f5f5b2", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621875746, "uuid": "8e32d04c-8355-45ee-92f6-5c2c629b914b", "comment": "Malware payload (Dridex)", "value": "fbae40db924379d666430cfdd4d5651d1bd1cbc0ebcc618541a682830ca33c4f1238748464d2871371eaea975da69519", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875746, "uuid": "8aadf6c9-e17b-4f36-be3d-2110e28298fb", "value": "7404B032C6569C82F84D263031ACF39A7A32AD77526ECB77C30DD799D3887A78029574", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875746, "uuid": "196d3681-b52b-42f8-adce-146c68d27f49", "value": "2849c9519293c05930a2817db7225c45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875746, "uuid": "d44508e3-2ff4-4744-81a3-d02fdf094a28", "value": "3072:cWpY/Syz2ita3Un6oaxewXvR2GNYHj8z+7/VczU9vh46WIOY4zmo3zAGW+r:cWpY/S8Z83VewfR2GyxVcA5hvjRCmikG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621875746, "uuid": "232e581b-2df4-4102-aacf-2be4d87193cc", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621875746, "uuid": "1a4f0785-18c7-4063-98f6-8ee2a0b2190c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621875746, "uuid": "a7bcc7f0-4c7b-4acf-9ba9-4d917b77cc61", "value": "cced650b_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41c7cc7-bcca-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1621886462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886462, "uuid": "f75f7bad-653f-4756-ab10-d3df17e024d9", "comment": "Malware payload", "value": "4895b457e686e24884fbce9fba2c2eec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886462, "uuid": "802e4c29-5b94-477e-96f4-715783eaed27", "comment": "Malware payload", "value": "cdbaac52f4a58fb84204a2110550741f0b40a391e6b6800c8e49729a6ffadcdc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886462, "uuid": "2e606731-6e86-4c9b-823b-15a33f854544", "comment": "Malware payload", "value": "01c8520ac841d4f134a1c480e9d32306be154389", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621886462, "uuid": "d354e9b0-dd97-4fc5-9c27-590da2a178f6", "comment": "Malware payload", "value": "fdf284f894602a3a273cfad1fff9bf851582cf10d519c75681841571e1a2d355d41d88e76c78f80605b4375f07fc3c87", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886462, "uuid": "05c4d181-127a-4f0a-9702-cdbd318a855f", "value": "BC758C366359CD02F72A0B7561D38A247871EF9F3221871BC5E1FA18F839BB56C8D264", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886462, "uuid": "6335fa4a-6175-49c0-8487-c62299b041af", "value": "478743f1d3d70c2a8c9bb38305173291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886462, "uuid": "6b5d2d96-5b18-4d93-91e9-9c62aa1ad4b3", "value": "49152:is3kMuO7Tb8fii23vtlJhOmaywo8Ubz3vtlJhOmaywoUUbz3vtlJhOmaywo8U7TG:ito4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621886462, "uuid": "c84cf529-688c-4abb-bfa1-e4ef5154e84b", "value": 1657344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621886462, "uuid": "450181d3-ef07-4429-8a49-812e6bd75069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621886462, "uuid": "07e720c6-eaaf-4e41-a882-262ab917dbcb", "value": "4895b457_by_Libranalysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661cdffb-bc55-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1621836053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "fc769c5a-9433-46df-b553-391bb96fcfd7", "comment": "Malware payload (NanoCore)", "value": "66ee5de8ddef6da12df267857ecd3269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "85ebc668-2e22-46e6-8880-4ac863eb3cea", "comment": "Malware payload (NanoCore)", "value": "cde7e767d7c581252d84fffc579492cf5df5eec30588f41bcacbc613ef29b40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "7fe389bd-fa3b-4f25-8303-3ecffecb33c2", "comment": "Malware payload (NanoCore)", "value": "ad23cbeba37329a87ecf20b4fa9400a72fd97826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1621836053, "uuid": "02ebba3f-1fd6-409a-97e6-a2e61910e656", "comment": "Malware payload (NanoCore)", "value": "cd8330333c616d088d36a2156a58207630e7135574d0699eac223ddd0a0f57974fe97a410a5cc58d6226e00021886f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "a09bfa8f-d0dc-4e2d-9bf3-269273bda3d2", "value": "B2256B2411BC42D1E15A31FCFA68707262AB744D7F4EB6C47AE8F73E34A91F196CA211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "1df70da3-6c85-44cd-a2cb-7d64a3fe9682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "331213b4-8542-4e9a-b6ac-a64365207f49", "value": "24576:v2f0PqEsq81cQHc5wjGIgeLo26bTpjZwBn9bVgi7QbPLReqWH:DPqEx81cQH7jeeE26Xp1ED7Qb1eqWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1621836053, "uuid": "ae59c195-a4c3-4a3f-a795-85af5051cb9c", "value": 1054208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1621836053, "uuid": "edb583c9-3dfc-4a15-b552-b8020bad0be2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1621836053, "uuid": "afe80e54-02d4-4374-b2f4-dbb246dad090", "value": "PCT0002982765627827BC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f4e54fc-bc9c-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1621866509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866509, "uuid": "9a1fac00-ca45-4b4b-b7e6-3a466ffae22b", "comment": "Malware payload (RemcosRAT)", "value": "5a1e5539d4735f1f4dea6c79179880be", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1621866509, "uuid": "f7667e19-fa30-429d-a76a-e1667afd5819", "comment": "Malware payload (RemcosRAT)", "value": "ce2a4851127ba6470bdc2db5b8f87be72bb919bf1c512e1d293d89dab76903d5", "object_relation": "sha256", "Tag": [