{ "Event": { "published": true, "date": "2021-03-30", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-03-30", "timestamp": 1617148982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "820ce176-753f-4a07-8ca6-149f0fc69368", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f467dadf-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106674, "uuid": "b9a4c8af-8247-490f-8109-b7a21df52bcf", "comment": "Malware payload (Formbook)", "value": "3230248e026f581fd691645b7f58db4f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106674, "uuid": "a48e8d7c-0565-45be-a103-152c93639703", "comment": "Malware payload (Formbook)", "value": "00025910f2e989e975dbba7c85939bcff16d2ba36719e99bc02c2c6c31c35519", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106674, "uuid": "5cb7420b-b104-4828-bc7f-3a24ba28bc02", "comment": "Malware payload (Formbook)", "value": "0d818f49fd32a01ea337024e3770df4f39ad098e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106674, "uuid": "b8e66a87-733b-4196-a430-1877fedc58ac", "comment": "Malware payload (Formbook)", "value": "4f12a23a0ff1d99c15ab51f0d7acd73d019b020eb3bdbc32a8f29db54e889b9e335fc75e1799396cfc196c5470e46089", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106674, "uuid": "de5a7252-8ce3-48d6-a623-47cb539dfea1", "value": "C554125D52E05477C96E08B200F2DA24F13FF34923754A4BBB1D2BBD3F572AA1929358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106674, "uuid": "d991887d-cfe0-4e15-853c-e3920850ba36", "value": "3072:UTs3BxJNmJkKawnK4lc9Xhz6HwHRWNBxmV6v7jDIo6JSoMVNnJs18grng/wWopKk:UAPYKNuQ4N7mGjEaoIutWopx26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106674, "uuid": "322ba889-f97a-4ddb-b96a-0076fc778da9", "value": 292864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106674, "uuid": "c93cc872-f9ec-43e4-a4de-2cdedaeb8afc", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106674, "uuid": "e540550b-a272-4b55-a487-26e0a1f9f368", "value": "Bista_094924,ppdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062b7789-9195-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135480, "uuid": "c89d2fd6-506a-4228-9a48-a1c015a9052e", "comment": "Malware payload", "value": "84f16b6a417b61008f63ecb8cb22f0ae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135480, "uuid": "1e808a27-6f18-456a-bd10-1ed22e2237bb", "comment": "Malware payload", "value": "00060ec846124d99d1a6ee4aee2473b8209a50b51fbc29f41a46dd28608f45e9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135480, "uuid": "1b80d0ac-a2ed-41a1-aeb9-2aab19ddc7fa", "comment": "Malware payload", "value": "dc4b7731afaf57c7bd7fdc23845ae4a4022d5ebf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135480, "uuid": "e44bfb69-c552-4cbb-abb7-d17df4bac003", "comment": "Malware payload", "value": "166099d5c37074e65ec9462b7634670e198f0fe1ded37c2a0e96d83963e3d5d4497338d589ba8e25aa554c7bdbdc1419", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135480, "uuid": "ecbea398-52ff-4cfa-8259-0abaf7085c61", "value": "9014BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135480, "uuid": "bfb38f48-4c0f-431e-b832-f5062fcb9021", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135480, "uuid": "3b1db2db-56b4-46fe-aa3e-43b688605de8", "value": "3072:z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:zJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135480, "uuid": "e305ce2a-5423-43c2-addf-99dd12fb3dcf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135480, "uuid": "26fc3927-6f68-47cf-b8d0-e2c1ae3e6e47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135480, "uuid": "04501a85-2704-44c3-9941-0ccf8e883d99", "value": "00060ec846124d99d1a6ee4aee2473b8209a50b51fbc29f41a46dd28608f45e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a804739-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126548, "uuid": "566d25a1-76c6-4dab-8929-00732606b4ba", "comment": "Malware payload (IcedID)", "value": "f10159e67fd0e28970441cce021d5a58", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126548, "uuid": "d0006371-8cf2-4c88-be99-9ae7c2167b7b", "comment": "Malware payload (IcedID)", "value": "00227ed8342f9729918250c7fd875c67bcca739020a38e7dc18402216eda6f9e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126548, "uuid": "e2075ce6-38b5-4baf-b615-4b72566d9cf2", "comment": "Malware payload (IcedID)", "value": "3aad7e633fad15fb762d8410597632f432bbc91a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126548, "uuid": "39f3fbd0-b528-45d6-adf8-c74c9f6ba6eb", "comment": "Malware payload (IcedID)", "value": "57ad06ac10044cad69250c9e9fe7fa0c448179d7e17ca773094c317f728b4a6ede86897e19831d04aff9443853f056f7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126548, "uuid": "50a5da18-d070-4790-a378-856d601a6b54", "value": "50B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126548, "uuid": "7d94d97b-7bda-4cf7-a051-2667fdcaef45", "value": "3072:O2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:OzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126548, "uuid": "14e61659-9a97-4f62-aa1d-26ae3df05733", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126548, "uuid": "017f2e71-b709-49ee-bde2-e995d0e1df99", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126548, "uuid": "a039a970-073e-415d-8999-9dcfc11a43b9", "value": "document-1154436485.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6eb866-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120703, "uuid": "78cd9f23-8450-447b-9865-7d9f0bf1ede0", "comment": "Malware payload (IcedID)", "value": "8052151096c5691db11a01c5a95f2a88", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120703, "uuid": "bdc5905b-300d-4884-9c0d-0baee401e94e", "comment": "Malware payload (IcedID)", "value": "0028dfded1ca01bf61207b3d795cfbab4d633e3bb330a0004f917e5a0b67c974", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120703, "uuid": "107bb77d-39d4-4f7c-9a20-f45dac5b84c4", "comment": "Malware payload (IcedID)", "value": "2ee3f07e6d2eb31c6349ba73c510d6aed44d842b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120703, "uuid": "3da7e344-3d90-421d-b613-4f05066dcd18", "comment": "Malware payload (IcedID)", "value": "943dafdc46a3b7c061064e15fae4c6172de8dfaa786e3f15b83105ac82d91eb7d2bbf0aab02072fe82133f28180cf8d1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120703, "uuid": "84fb156c-19c5-4b4b-adcc-cb1f8b0bde51", "value": "5FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120703, "uuid": "9a059d36-e969-48cd-ba05-7a03bbe19e0d", "value": "3072:Q2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:QzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120703, "uuid": "46ff6845-07b5-4aea-83be-2a0879cfd24f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120703, "uuid": "55ba558f-8d85-4e6c-bf42-d07203114dba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120703, "uuid": "c2c4a979-ef84-4522-bd74-722f221f83f6", "value": "document-1330816492.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75b0677-91b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617147347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147347, "uuid": "e9b64637-cb41-4609-a4f7-20bf8c4e2353", "comment": "Malware payload", "value": "ead42a0ab37411a5c479311c91348dcb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147347, "uuid": "16aa77eb-07d2-4375-8e2e-251bdeac175d", "comment": "Malware payload", "value": "005fcf085e3672ba431d14c495365740cd9c3424da315ddb9bf205273c9b173c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147347, "uuid": "0a29b144-05f4-4cb7-9a2c-8aa112c679e1", "comment": "Malware payload", "value": "308daffd0889259b3f5ca973de652b198d2806c6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147347, "uuid": "1d426a71-1d75-4dea-a7d6-fee55f081910", "comment": "Malware payload", "value": "e8b76207eb1790ec02cb5c512ab0a5b935b6e575bfb4529eecc66e460159de63a1ba5968dd6b10696f27d1142fda874a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147347, "uuid": "8ef29cf8-a2af-4181-8b45-b9576cf323df", "value": "E814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147347, "uuid": "da910c7d-ecd8-4e50-85e3-e73edac0e1b5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147347, "uuid": "012d88c3-c47a-4887-adeb-dac5da96aa10", "value": "3072:w3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:UJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617147347, "uuid": "cd02dcb9-27a9-402c-871e-bc736474a37a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617147347, "uuid": "7d2c019b-480e-434e-a844-d14b56fa56b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147347, "uuid": "a23ddcc3-1302-4394-84b1-25397480b774", "value": "005fcf085e3672ba431d14c495365740cd9c3424da315ddb9bf205273c9b173c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1853e6-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142526, "uuid": "2a67cd7a-df3f-4bb4-84ff-f76fbe4d7c98", "comment": "Malware payload", "value": "d28236fd80e405c895d326862a36b700", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142526, "uuid": "acf7d44c-bc88-4154-b9dd-3c8f340d0221", "comment": "Malware payload", "value": "00764f7868aeae569ea73e9df93d7e9218587dc0c21f45c034f36789a92fce9d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142526, "uuid": "ba031c62-434b-4320-a052-82c4c8ae0384", "comment": "Malware payload", "value": "f0b0e895e3a28b2c7c2481978027aa6179c2d4cf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142526, "uuid": "20b87db2-14b5-4d8f-adf3-ed8dd459279d", "comment": "Malware payload", "value": "fe81e3818b0653d26b29378105524b7fed2d88e949b9247d867b398305e70a694b433e461f8fa07d8c26df546c82a514", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142526, "uuid": "d8be69b5-c4f0-4405-a8b6-7f44f91a8710", "value": "6214BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142526, "uuid": "ac808f6b-db46-4e5c-96e7-67d346f87958", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142526, "uuid": "61a55091-d626-492b-bb60-0c1925c903e0", "value": "3072:H3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:fJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142526, "uuid": "ff7aea24-5420-4b4e-8c97-69109a1994ee", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142526, "uuid": "59a05173-c13d-46d4-bcc4-bd39e94256c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142526, "uuid": "85c8ba8b-9d2f-4a73-a581-84f3021da943", "value": "00764f7868aeae569ea73e9df93d7e9218587dc0c21f45c034f36789a92fce9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a66c2c-9148-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617102758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102758, "uuid": "78ceb9ce-06a6-4bc3-8b49-226262851363", "comment": "Malware payload (Formbook)", "value": "f2b3b1f8b907032efe5255a5d8d187f9", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102758, "uuid": "8d77cb87-27a3-4272-a0cc-e67ecc1d6b68", "comment": "Malware payload (Formbook)", "value": "007d92550421bc96492e77134c99d3c13e412bd6d574c6cef374f31a1683299a", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102758, "uuid": "31f196c0-e5fa-4f54-b552-f50b93e9a792", "comment": "Malware payload (Formbook)", "value": "f544dd20940286dcd62c3a6e215b76b2c0d41911", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102758, "uuid": "78254e3b-d5d3-471a-af0e-4dd3953f4dab", "comment": "Malware payload (Formbook)", "value": "f8b0f88ed45151bc762ffe245db9d8057dfdea7be48561ae6759453506164dc78e780d389eee957072082498d5a7f24f", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102758, "uuid": "93ad90a0-5c2f-4eac-b1bc-f80608fa8690", "value": "1454234F9E14BBC2B102AC955619FD81B4408EFA2354C8A22E2E190EEDF171F753D6DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102758, "uuid": "392df04d-2910-4934-884d-5bd0535cb08f", "value": "6144:nvkpFPnsThiLeAqnps0G6DMK/6fztVkAnmCvl9T+1jjAhki+3rj3NCI6c:ncpoiLeznps0LDMamtVVnmolEBjCk1rH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102758, "uuid": "d80ad06e-5b05-41ef-97a9-88ac90bec6ef", "value": 292628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102758, "uuid": "b4ce6b8d-7dcc-44d9-bbef-63b243842c66", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102758, "uuid": "6866a13a-9b23-433a-8457-17ce82c42433", "value": "PaymentInvoice.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28b3449-9187-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129783, "uuid": "899f7f06-2e1d-4c69-8a7a-f0ba16bc0f7c", "comment": "Malware payload", "value": "d2be6f55dc7434411993d966d0242115", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129783, "uuid": "071359ba-cdb9-47b1-b47f-0dde068c78ee", "comment": "Malware payload", "value": "007eac982772b6daa70f67691a4407c577f2f7f07339142401df5870e2733435", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129783, "uuid": "85316df3-bc37-4b2c-a487-8ec5d575691a", "comment": "Malware payload", "value": "bfbdcd5a410ac1a44c03f2651cde5460f2f172d6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129783, "uuid": "a67e377e-3601-475d-9305-2526ef3886f6", "comment": "Malware payload", "value": "ed4e3ee46b1fc5429f88e7cb7f67b62523a09e86af1476efe933b5bf63e89f34a5379f11e9b405cc00b17345740fb5d0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129783, "uuid": "cab97dbe-dbe6-4457-b5c9-b8c253f1c93c", "value": "D014BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129783, "uuid": "b86f0a30-ab94-4dc5-ae0e-c274227860bd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129783, "uuid": "6c1a1f9b-257c-469b-9955-e139ad5ede73", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129783, "uuid": "77f9d2e4-5933-4032-bd1b-7096b9a45b20", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129783, "uuid": "c8d090cd-4b3e-4d37-a0fb-2cb94f8bd4dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129783, "uuid": "b7ea71f6-d1b1-45d6-a932-9329b654608d", "value": "007eac982772b6daa70f67691a4407c577f2f7f07339142401df5870e2733435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dfd541-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121548, "uuid": "697c0e0b-59d6-4c09-bb6d-556cb4f2e938", "comment": "Malware payload (Dridex)", "value": "26352494b35a7140cb743ea136ce018e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121548, "uuid": "c29bae28-2e71-49d2-9610-a7886cbdf88d", "comment": "Malware payload (Dridex)", "value": "00948a0924b5fc7be5121bf7861deb77950c6864f9e92435bbc057e8a6bdaf4c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121548, "uuid": "a517a91a-be13-47e5-a3cd-30ce88b08033", "comment": "Malware payload (Dridex)", "value": "2d8b2b147e308c3e42816c705711c511478b8a5c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121548, "uuid": "baa1a2ec-0c80-4de6-b081-d871f5ea9189", "comment": "Malware payload (Dridex)", "value": "a475e61fe79b90c39a15712f35a9d231f0aa00d9f3847bea30dde323171a7989b25f212310171314d6ac88d00dfecb55", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121548, "uuid": "48f90b97-2b51-43c7-ac40-612fdb5c63c9", "value": "8114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121548, "uuid": "fffb64f7-4646-4e53-b9bc-2d971ae3927f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121548, "uuid": "99aa89b5-de9e-4515-9881-45f4261163d8", "value": "3072:P3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:nJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121548, "uuid": "52e4b0d4-09b8-45d5-8f35-1b2f96af2546", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121548, "uuid": "c6de9b7a-5202-4774-978c-6d1cbf185864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121548, "uuid": "f2f64173-24c6-4415-b3c1-f0e9dd111c9f", "value": "00948a0924b5fc7be5121bf7861deb77950c6864f9e92435bbc057e8a6bdaf4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ea541b-9106-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617074355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074355, "uuid": "0e105ffe-a441-4cb7-ae71-4504759284c4", "comment": "Malware payload (Dridex)", "value": "7bec0406ced2e9f578e86ad62585652b", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074355, "uuid": "43aeefc5-ca8f-420d-8b48-ac6308eb5abc", "comment": "Malware payload (Dridex)", "value": "00a586f014e04b381899a555f8631173d6642fb0745cd5b8a4c4d1ae15c5e8fb", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074355, "uuid": "c0bc247e-7235-4066-84f1-2596eab43292", "comment": "Malware payload (Dridex)", "value": "6ff5eca6f4f82bf2c0da03f77fbc30cc492f235e", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074355, "uuid": "1c1eed08-10df-43cd-be19-8e3dee5100de", "comment": "Malware payload (Dridex)", "value": "9f76057a03c1bb4b3a9e4bee2a845fb69dacd8f0af487fd3ee160f8f898c9aac8638dfc3705b59dc9f4562307b333260", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074355, "uuid": "1920f526-f0cf-4c89-a961-7a33570d0d64", "value": "C1C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074355, "uuid": "94f7ec15-cfe9-49df-be49-79f9ea0b2c3d", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074355, "uuid": "cd64cc82-4a15-499a-a87a-17c06c398be3", "value": "6144:mGiMOQpsduhD3AZHC/uNbExd+4duw71b0717WLmw6Xg6DqaIDnnlvghV5la:nVhDQZHC/uNYj/7Rm8LYQOQlYJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074355, "uuid": "a083e87d-5f7e-40f8-b723-d3e462e74f89", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074355, "uuid": "735a70f6-6721-426c-a484-0d90d0483a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074355, "uuid": "c4400bf3-a592-4efe-b020-898b7037b024", "value": "00a586f014e04b381899a555f8631173d6642fb0745cd5b8a4c4d1ae15c5e8fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fbdf7d-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617105626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105626, "uuid": "2e1db632-cce8-4599-a6b4-2f51076dbca2", "comment": "Malware payload (NanoCore)", "value": "96543e758e8b3e89aa6b8bd27ce88eab", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105626, "uuid": "78709388-0802-402b-a7ce-8b16b053453b", "comment": "Malware payload (NanoCore)", "value": "014986bbab300c17a901c938a9cf30ed0841bc6c16d9fb5f7db0ba0ab9a2e851", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105626, "uuid": "2b4e4c4c-ec56-4863-9e33-b6e2f5c1b48b", "comment": "Malware payload (NanoCore)", "value": "a800065e06fffb15dad3127162b86d9acbec7cc1", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105626, "uuid": "21359bba-3c41-4650-9e8a-7c60a15c9c3c", "comment": "Malware payload (NanoCore)", "value": "e1540dfa8c0262656dd90731933e288c8ad5d812076c51ca6dc407cf6dbedb51b98d896a7fe499d30e4c90c4237f7d40", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105626, "uuid": "b6b7ea2c-177f-46d3-bfd7-5b2d781c22aa", "value": "0ED5336D28E3DB07D8940DB0DA8BB83925E3AE607F5D4912B2293273203777587C7B65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105626, "uuid": "e8ba0d33-c770-449c-a16f-978bb989cd9e", "value": "49152:iBqNkqX+g7wLglabBpFA9pVFo9GmJzwyXIdPQZ7N7igsTtlR08y:MYVjx0pQa8mJUyYOlsTva8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105626, "uuid": "0f402d65-6b8d-452e-a3f9-45e822b65d1c", "value": 2761728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105626, "uuid": "8c195287-db8b-43c9-92b5-1d4a6597075c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105626, "uuid": "d88412f4-58eb-42f1-b0e1-c7c39a324554", "value": "LOT 15 - Transfer Manifest.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234b2cb5-9125-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617087425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087425, "uuid": "a2eab598-c073-435b-bdde-99fcbcdd333a", "comment": "Malware payload (Loki)", "value": "468c93e5239a913a710dcee96878bc32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087425, "uuid": "3add21e9-269e-43f2-8f77-9b2356e6b2e4", "comment": "Malware payload (Loki)", "value": "0153fdfbc02d929c7f92cd1f4826de2d6a3db1c86cf6c7b79e90169065345480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087425, "uuid": "2b00bb99-99e7-427b-aaff-b705e3cd8f8a", "comment": "Malware payload (Loki)", "value": "c7fbf4dc29b16524f6383fd443e1b866f01f482b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087425, "uuid": "431a94a5-c57e-4e19-84fc-fe1f377b195f", "comment": "Malware payload (Loki)", "value": "8c84347992bd3fa94dca23b5fe9ff653f9c24ac8a5ddb4686eac7d9ebb9ac1047aae571b81278b141a59486a8fa70d2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087425, "uuid": "3a333aad-61cb-4a45-b9ba-19df0d188c00", "value": "BFD48EA870AE005DEEB46774F5B695821FC825321F62FF3F28E657005CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087425, "uuid": "c22ed5fa-35e5-4710-9344-1d799f1c9a2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087425, "uuid": "e67a8eb3-bddc-490d-b835-f80317c0e4de", "value": "6144:uaUUrO8AaeE6GULkeiCw/xRWWchXvQr9HE1d24Eq9r/nc8CHrOIKQm0umL7dov2H:tsZfw/xE3hXCFcGk/RY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087425, "uuid": "97c4c73c-9fc3-4e5f-9f4f-18d31078054d", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087425, "uuid": "ba0ef36e-8995-4e08-b2a9-a19517e33566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087425, "uuid": "48087657-3188-4650-957f-2d1f19caaf55", "value": "468c93e5239a913a710dcee96878bc32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3b5dea-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "44ae4263-4a6e-4f46-936c-0c7843cb3dac", "comment": "Malware payload (Dridex)", "value": "b428448a9a19d6b70f465246b0b50707", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "37c0884d-643a-44ca-a26d-1a085d7e0b85", "comment": "Malware payload (Dridex)", "value": "01b923a9a618a087ac431d40625fff826f7cda0837ca6c8aaf100e049d1285d4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "e5d666c4-4267-4b6c-8deb-8a4d34e63b49", "comment": "Malware payload (Dridex)", "value": "10207336a11f65afe396bfe1bd43b51a237c1dd2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "1d339b0f-d2cc-4b8c-9222-ef014d189734", "comment": "Malware payload (Dridex)", "value": "54dbf35761d871ac474c28c5635f52633c078ac9729661012c406c3a581697ee0ae3f4ee33e929c8e769d40eda4ec92a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "11851dca-13a0-4a06-b183-75acde30f139", "value": "C714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "e152ad7a-c8cd-4c50-a88b-596d1606ed43", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "dfaa4120-e09f-4094-a4ae-b52bd65f9153", "value": "3072:u3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:KJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114092, "uuid": "ac84d770-c18c-4349-9b06-bf6ac41cd2ae", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114092, "uuid": "8cccc557-a2f5-4e28-ae81-84e3b848f429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "fc88d8a0-a505-453a-9031-c59da02dea2e", "value": "01b923a9a618a087ac431d40625fff826f7cda0837ca6c8aaf100e049d1285d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28884b52-9169-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617116640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116640, "uuid": "91d60525-3aac-4a44-ab1d-b48481330cb1", "comment": "Malware payload (Formbook)", "value": "93468a4fe48745648b86cc851436b386", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116640, "uuid": "67ec85f3-d206-4d9c-8a63-4e677729161e", "comment": "Malware payload (Formbook)", "value": "01c3a81bee9855c295763ea43be9142171325586fd3046bf4ec0a2d4390cc3e3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116640, "uuid": "1d864679-7575-4b8c-a0f1-aa5278c7d0ae", "comment": "Malware payload (Formbook)", "value": "5f48d7b9fe27657386bb6be4e29c19d0dc754e4e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116640, "uuid": "ceaf90d0-cb18-4036-aef0-57c76aeb345f", "comment": "Malware payload (Formbook)", "value": "aa7817229ceb695db21747e870ba7bbef8efffe048fa379c0d41e50743dbeb58622e800ba9a2aff94599f0976348a321", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116640, "uuid": "d961e348-2009-489a-838f-e5c7bce38913", "value": "58156D4C5B99C18AD5760A64C1D983F942A96EF2FB22CC6BA5C43FCFF5317C0A506263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116640, "uuid": "90d635bc-33f7-43bc-a9f3-1423fc9cdfd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116640, "uuid": "5dcc738a-4e83-4ee0-bb72-b9c9ff231e8e", "value": "12288:gVEcJCXLlZEz7bCUYBb/gtxpEGs+QuStqbiWhD:gVSlZA7bCpBb0xWGsndOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617116640, "uuid": "3d082037-c712-4ba5-92e5-539c1bed938a", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617116640, "uuid": "027c77f7-7208-40a6-b7ec-011c17fea007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116640, "uuid": "8de89f6c-0e39-48b0-8a38-9b7114669789", "value": "MACHINE SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec222424-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617085615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085615, "uuid": "bdab7288-b8e5-4916-9429-e427155d49de", "comment": "Malware payload (Formbook)", "value": "6de77759b378fb8dce0601a589b77755", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085615, "uuid": "f233a447-2b6a-4447-9276-a2f15503d5f9", "comment": "Malware payload (Formbook)", "value": "01d2c24c54fb1bb58da01982f6ee58a558e53ea94fabb7ae8fbdb04be54476d5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085615, "uuid": "480a6a1a-8993-4779-83ee-9ba3083e80c3", "comment": "Malware payload (Formbook)", "value": "c416b0ba2b9086b2fd99ef8abfc17a048c327963", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085615, "uuid": "8a24b7b9-7d52-401a-8602-7d1d3bc52e57", "comment": "Malware payload (Formbook)", "value": "6afc5a1916e2a924e79605aec290c6cf820e0ce0a7b9bf09a079c884939c1ee656f1407cf3152ee66f77e702511dc9a3", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085615, "uuid": "73398bad-5aef-4f0a-9c4b-7e6863a3560b", "value": "1A34233365363FE75888BEBC62681CA10D337B5A28C6957CE5A49049850BB74F183F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085615, "uuid": "4fe05429-439d-4b0b-bb0c-168d5d4997db", "value": "6144:uX4sbeKqFTUEDZqWaxvbyqQKOBkzDPNt8f4NFq9cn:PselBaxvTQK2kzDPNtqMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085615, "uuid": "74ac5a28-50ad-480e-8fa9-9fe8fbf4578b", "value": 248138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085615, "uuid": "38651d2e-6b31-4586-ab69-bc9b85808d81", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085615, "uuid": "7963c000-d05c-4da0-ad4c-71570369fe05", "value": "SHIPPING DOCUMENTS.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50dc4ec-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137491, "uuid": "b95c82bd-86d6-4225-b9f2-2056c28edec6", "comment": "Malware payload", "value": "0f950ada3f6c027fbea8cee26dcbef05", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137491, "uuid": "d0e66b5f-b10b-4853-824a-8128d8c6fa59", "comment": "Malware payload", "value": "0306b02919a6aa97d33844bb741de43d75d565cfa625102165a05b8d17cc9c0b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137491, "uuid": "8cdc0cd6-1084-4ad7-a70b-1ba615d48805", "comment": "Malware payload", "value": "caf3fab2702643789243b82cae91dff9657a7eec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137491, "uuid": "b1f2646a-8d38-4f7a-a1e5-29fa023d12f4", "comment": "Malware payload", "value": "79b89bb4d8cb601e4edee81d868048d90da6deee5a30ab6d2b6acafcb1fa90acf00a8d2424547f15fe054b8f4234a46d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137491, "uuid": "b087f77e-fa92-41d8-afb2-57fce2eb6431", "value": "5014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137491, "uuid": "d48b5349-7e44-4981-bdfb-4bb86563c4b3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137491, "uuid": "3a0bba3e-08ff-4b1a-b959-c3fbf905bb1e", "value": "3072:E3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:gJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137491, "uuid": "eb092fd1-7e00-44c4-90f4-834d0cff1ee2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137491, "uuid": "220b2d0d-3605-415d-b257-46f3eefd50fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137491, "uuid": "c6748c31-6842-4be3-bd85-ae2a96c814a7", "value": "0306b02919a6aa97d33844bb741de43d75d565cfa625102165a05b8d17cc9c0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9cb6381-919c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138895, "uuid": "a827d262-c711-4166-91ea-7e2cf98fb3b7", "comment": "Malware payload", "value": "67788b0cea409b69749bf00e10caee78", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138895, "uuid": "aef3c265-05bc-40ce-93b2-2723cc975a44", "comment": "Malware payload", "value": "030f8bf293bbddc4f84c8e4ae7573b13b1869aa115bd20731f763e39ac7390c8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138895, "uuid": "84760350-bb3d-4e6d-a9e2-936d55931558", "comment": "Malware payload", "value": "78c484d8f0a3bffad73fd382cc8b453ae2ab1359", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138895, "uuid": "b8ca8a3e-e7a7-4c8c-a1d0-c15556ffb636", "comment": "Malware payload", "value": "840758b618dd470ce7aab6bf337abcdfa6f6c681baaf87273eb33eced9eab114d10a467f7afe26b39b27d683ff09efbb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138895, "uuid": "2fe7c769-3992-499c-b127-6a01f9274ac5", "value": "8314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138895, "uuid": "3d90a9a9-3f69-413c-b505-caa27d433859", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138895, "uuid": "b299bc44-c0b5-4a64-bd20-dd7575789034", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138895, "uuid": "692a643f-63eb-4b68-af3d-4a0507f93b30", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138895, "uuid": "38123694-b5ce-4e0e-bd6b-9206434334c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138895, "uuid": "08e5fbeb-1d9b-4f25-9915-80c0671b7039", "value": "030f8bf293bbddc4f84c8e4ae7573b13b1869aa115bd20731f763e39ac7390c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30e34685-917e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125673, "uuid": "5fafab8b-3515-4a61-b511-a0de1997d453", "comment": "Malware payload (IcedID)", "value": "7eb7f0af943388d48cacc00b51d51b5f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125673, "uuid": "c4c4c98e-9ed1-471f-b1e5-a88d7cbb4252", "comment": "Malware payload (IcedID)", "value": "039e2b7ec127deb944465f3047a7099baf2ecc400edb02080a2a35ac805032ba", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125673, "uuid": "33ef7dd2-c2b5-44e2-b310-ad965ba2cb44", "comment": "Malware payload (IcedID)", "value": "d079422fa8b0a997237758848e8b30fe45b2aec2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125673, "uuid": "fc8769a3-a81d-4c0f-8b52-b6c30f5afa1e", "comment": "Malware payload (IcedID)", "value": "f71007d324374a55d1e570c7f6a24906f8878316b777effc782a12061468136cbe0453f5725c4b884351647261a10428", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125673, "uuid": "3faad4ac-1699-48a0-a177-f9e5e3c53a46", "value": "4DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125673, "uuid": "a097624c-649c-4540-8dd6-e97895c3f98e", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125673, "uuid": "a9a88042-2ae5-45dc-8914-5f733c8a0a03", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125673, "uuid": "04b81bd3-8795-459c-a65e-b46aa3a76ec3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125673, "uuid": "f520c94a-064a-4106-bc17-af280e6d6284", "value": "document-1930190597.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfb2b5a-91a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143623, "uuid": "56e9efb1-df67-4686-b3ce-2ce90686cdf2", "comment": "Malware payload", "value": "3d0fffa0fe157c3bffb917e6a8d9da2e", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143623, "uuid": "ebb2ec45-d645-4315-af3d-dc52ccc216a5", "comment": "Malware payload", "value": "03bb64d1d0d91623bd8d83e769e97d39cf8175584dce06bc07936a8050ee4e41", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143623, "uuid": "bf2488b3-51cf-4556-a243-f9a3cbd19a7f", "comment": "Malware payload", "value": "3e7f43dda78e1d8136bbbb1bf28667d4632c661e", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143623, "uuid": "9dd7b077-ecf9-484c-8398-0e809f6f7dd4", "comment": "Malware payload", "value": "f9aae01aa5685cdc77f298a72a355e9db91e956623de8463c42c6edcab61971f3135fdc5988c187981515c600b9a4244", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143623, "uuid": "80fcba80-0edc-4d78-ba58-c2cf5dbf68b3", "value": "B3C4AE12A5629039F8B347B689FF594941AEBE90073464CB73C8996D5B7BAE03F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143623, "uuid": "2b269799-23ab-4b7e-905e-153a92d97abd", "value": "adeae1388ccab7d5ea2c08a636428844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143623, "uuid": "bfb5da38-483b-4dbb-bcf3-3c9d2b376612", "value": "12288:ybHAqgIuNsQBUZGlXA21Sp3vykrYIotUfd+G+3kZ:aBCNrUo/CakrY4dZ+UZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143623, "uuid": "e4ec19ee-705e-4a18-b2b5-bba12812b4a1", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143623, "uuid": "ead701c3-9856-481d-af2f-c1fca93c4c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143623, "uuid": "15ae6f49-701d-4ac0-9e3a-af6904e2c10b", "value": "03bb64d1d0d91623bd8d83e769e97d39cf8175584dce06bc07936a8050ee4e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8fa4c5-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120702, "uuid": "28aeea0b-6fb1-4658-b9a8-d4ba3987da71", "comment": "Malware payload (IcedID)", "value": "95f082b06a2e18e3b7e3239876ff9df9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120702, "uuid": "c66d5d71-ec71-4439-89a1-be0ed3c30b49", "comment": "Malware payload (IcedID)", "value": "0453badd154b312f154dc0d341995380590ee6c5316483834ad15149868a5f8c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120702, "uuid": "e5f286a2-9e88-4986-a32a-09dd1f53d9d9", "comment": "Malware payload (IcedID)", "value": "0bcc4d6fd1f7cce7a77b0a1ea603e7206df8ff0a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120702, "uuid": "cd1cd447-2606-4124-985f-63d5a6c7afb0", "comment": "Malware payload (IcedID)", "value": "c9b344e4b5d11c2e1822a43d88e2492886d786ae55bc21d1468f699c1ecf212c562ad753fb27e7cbda1ac94a1cf63677", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120702, "uuid": "a55a05e1-b842-4f8b-a145-a3b6ab174e49", "value": "AFB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120702, "uuid": "f96ce8bc-49ae-49af-a8bf-1c07a83e0869", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120702, "uuid": "b4fa3822-e2a4-40ef-b1c3-e54f1d16d765", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120702, "uuid": "d0e286fb-8fa1-40f8-a984-e639279f3c24", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120702, "uuid": "c6855b07-402c-43ca-86f0-b0392de492d8", "value": "document-1191515916.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a615f2d7-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617085497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085497, "uuid": "653b59de-957c-4ce2-a6e6-3a3c11a4d23c", "comment": "Malware payload (Formbook)", "value": "ede69ed42c85c61459145bbce2fcb585", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085497, "uuid": "e4782849-97f6-4ef6-beba-fc11ae5b3efd", "comment": "Malware payload (Formbook)", "value": "04df6344497e9d1c321f32b61df87db549d179c6c66c3bf0b2cc7f6b1510040d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085497, "uuid": "9c148688-d2f2-415a-b6dc-7e9548c6f24a", "comment": "Malware payload (Formbook)", "value": "abbfa669f9cf688f0ff116d0c624bdd57990a819", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085497, "uuid": "bc399a57-3117-4350-b208-650dc5d78650", "comment": "Malware payload (Formbook)", "value": "5cbc248abb439ca86d25f95ff75c190f9d5b31a6bf7edd373c2d76a2abd78d4ed41c74ebcb6fb20d87e678a3b195671e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085497, "uuid": "0473f0a4-d7f5-483b-b1e7-e92ef67bcf51", "value": "B5241236B1F589B7E97806B005F77BAAF3F9F346335065232B680E5D7A20142E6106DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085497, "uuid": "364e1b95-b5e7-43b8-a8be-4280a5998d48", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085497, "uuid": "7675d79c-f839-4148-8c7f-4a3d35ae9f5a", "value": "6144:vAPIpHmX3gQEoaXLa172nOLVZFfjUHh6c:qX39G7A7LVZqHh6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085497, "uuid": "043eb459-7297-4099-8c71-81e26aea4811", "value": 214191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085497, "uuid": "ecb33c60-1ec7-4d4e-80f6-e8efaf6f9410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085497, "uuid": "93eb8596-ee5e-429c-b3a9-c26c55179294", "value": "Swift001_jpg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff655bf-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136812, "uuid": "9fe263e7-6f48-4c4e-a2a1-5dc779207aaf", "comment": "Malware payload", "value": "9438f2ae6bb3e0ddcb7ebf6a90f4f799", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136812, "uuid": "a142fa06-2c6c-4a4c-b165-f64e1a2fc934", "comment": "Malware payload", "value": "05a3a79b01eb121dd8ace221be7bb52e20fd4336d9188757ae8c69826a43e51a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136812, "uuid": "f15277e8-577a-475d-8448-937ae1c24cb0", "comment": "Malware payload", "value": "cdf015986974ff6539cb27c0b6a8d8357794d595", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136812, "uuid": "b4d583ea-b12a-47dc-90b2-6fc6d36b3b8c", "comment": "Malware payload", "value": "7829db66cd099f09d3e8f8330ae10969ab5dec4225bd55a4a62edf79dd82f11541a4922f9955903bf437d3ddcb0835b0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136812, "uuid": "a6e4df6c-4c8d-4366-9305-637480b05967", "value": "3914BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136812, "uuid": "9251067b-b39a-419c-8f82-8bbe9dd42775", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136812, "uuid": "e37d10d9-c00c-4303-9ae5-db399c42badd", "value": "3072:P3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:nJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136812, "uuid": "5cf847e7-de94-4827-b658-005f49462aab", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136812, "uuid": "330fac7f-555e-49e5-965e-af66cf150d74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136812, "uuid": "db0025bf-05d7-45ef-9743-1deeacc4364e", "value": "05a3a79b01eb121dd8ace221be7bb52e20fd4336d9188757ae8c69826a43e51a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52849215-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115422, "uuid": "c72ebaa4-9c48-46df-b66e-fc270d3e9adc", "comment": "Malware payload (Dridex)", "value": "a78a6d03e11549ea438152db007861ba", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115422, "uuid": "fd539f52-9be0-40b0-9e2e-9871848c7dd5", "comment": "Malware payload (Dridex)", "value": "05b9e72c70945a94308c984ddf48ce47b275d01741514831c66496d867ed8a7a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115422, "uuid": "73f100d4-bad1-4a7a-9c1f-43f75e868644", "comment": "Malware payload (Dridex)", "value": "7c2671194b1d48d531f36ffd547ab109d769b098", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115422, "uuid": "7f8fefc6-b997-4f18-b257-a81f6a248cf7", "comment": "Malware payload (Dridex)", "value": "726dd674e47c355b6f464c81b6c80f46c23a523f048fc5d499c66423e0a54362f0a105547996d178e500e9d65decc73d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115422, "uuid": "9330205c-1123-4379-9f91-b39f220b185e", "value": "0A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115422, "uuid": "a32d0d49-a564-4565-9144-68ed7f99f4a4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115422, "uuid": "68b87d22-71de-40bf-aa63-b02a7f70b23d", "value": "3072:l3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:lJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115422, "uuid": "5455f46e-fd68-4000-b762-3ca099757206", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115422, "uuid": "aa7ee944-14db-4c26-ba9e-7ed1074fef5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115422, "uuid": "cf3b480e-a33a-4e39-926c-0f4d9c1fd99c", "value": "05b9e72c70945a94308c984ddf48ce47b275d01741514831c66496d867ed8a7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2dd316-917c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617124993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124993, "uuid": "86592394-ad2f-40d3-8216-88adcbf6ad5c", "comment": "Malware payload (IcedID)", "value": "8de081c90137dc27ac06163a8ae4ff2a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124993, "uuid": "55028899-b146-4611-b1ba-3a02ffae5337", "comment": "Malware payload (IcedID)", "value": "05c95275f1e83d4990e9859c50a135bd6c8de5bf8f3aaafe3d52300c65210aa4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124993, "uuid": "f918bb29-2823-4386-81d3-4129e317e358", "comment": "Malware payload (IcedID)", "value": "9f7ac55f8e80ffbfc21341d82a24b9fc4273ffe8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124993, "uuid": "7c19aa94-cc0b-4961-a989-33733b2bdf56", "comment": "Malware payload (IcedID)", "value": "128d554a2bbf3f18aa7a72e5ed8676cb33d7cc4bbb85bd101eaa27eac3f81ed4fa2f368503d406e77652573946ad8790", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124993, "uuid": "bbf769ec-17fb-4c3e-81be-1a86effe039a", "value": "45B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124993, "uuid": "6adfb3ce-ff34-436b-ad06-9f29d1856d8d", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124993, "uuid": "f80d4209-ef46-45f9-b07f-2f0e1592d784", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124993, "uuid": "18ff89a7-4247-48c7-b73d-2f77f4bedeb0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124993, "uuid": "ccdea9c5-f9af-4bcb-9890-7c9a40685b88", "value": "document-440278645.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743f6eef-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617088420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088420, "uuid": "d66a61a6-1f0f-403f-a458-784f9e09c294", "comment": "Malware payload", "value": "2e59bf0510ff753c4448a3a428f19db2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088420, "uuid": "45093c43-1422-4ee6-99ce-f95fd6604451", "comment": "Malware payload", "value": "05ce34031e655fdcea117c738f83a823109f3c9d17db39315fadeceb44ab7068", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088420, "uuid": "eb2f9790-f866-44d2-9625-c4fddb153f86", "comment": "Malware payload", "value": "82589d4f9b5250f1ca9d512ac5943fd8afa94f91", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088420, "uuid": "c9ecd75e-bf75-47a4-8ef9-973000192dda", "comment": "Malware payload", "value": "b438d50810da79e3a53fbdb91c68e1f5b66cb13e1be889994cd2ecb9dadf4c592d73bb9443fff9f83a1b2d4d9648af3c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088420, "uuid": "92a494ce-d14b-4443-bea5-1a79831dacf1", "value": "FC34E08266A254F9C46F8338DAE30B85E3B4F429837553CF536482661F736D86E3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088420, "uuid": "2c5344ce-66ac-415a-a804-9869030d008a", "value": "a82ee962c2400be0e0e4803eb65a2b0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088420, "uuid": "1fb5abba-1345-4994-9d3a-831dae2acc05", "value": "6144:ANR3Tp8qZOwFxZhK4STmFx7HUdOIpmUzt2GswYcM:A7318qG4S6FN0dOIoSYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088420, "uuid": "66daa744-9422-48ad-85a9-21c3e9e90dd6", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088420, "uuid": "0b8c47c4-53cf-4eb4-b5dc-6a590c214c28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088420, "uuid": "d7c72c77-8730-4bdb-91d5-307276adb4d1", "value": "2e59bf0510ff753c4448a3a428f19db2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de702784-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118233, "uuid": "973bbaae-e62e-4bdd-b325-62178cfd5b6a", "comment": "Malware payload (IcedID)", "value": "da6f148cccf1c22524ebf4e4d3307cfe", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118233, "uuid": "5891ca70-ab82-4269-8507-976c1e28b4f7", "comment": "Malware payload (IcedID)", "value": "062ad660e27184610e20d3669c0e3b78f7c5bdaf9f3d1ee11bf25697c7a8055a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118233, "uuid": "e7e935f7-f3db-4677-8485-9993f831c5dd", "comment": "Malware payload (IcedID)", "value": "ca2a2ffd11b0686e56b2a79984b5f5f97143371f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118233, "uuid": "5b711be6-b2b5-47cb-82b1-a28cd131356e", "comment": "Malware payload (IcedID)", "value": "2e490193d1b604cb8f5b3f2d2a166d1d9e2690e575cc88f2eab64ba0bd10f393fc8c899194a36aae0ddb09b568128eee", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118233, "uuid": "5afaec48-d81d-4640-8dfa-a0322f5459a5", "value": "25B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118233, "uuid": "bcd3e848-280d-49e6-82d3-2a2e1ec75177", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118233, "uuid": "753eadf8-069f-4daa-92f4-4971869dcf78", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118233, "uuid": "00904431-1fb1-4c24-90b5-b5c1ce924398", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118233, "uuid": "5f278189-313c-484c-8b50-3ae50580e343", "value": "document-209343377.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c5dd207-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120458, "uuid": "7b891a82-1c57-4651-9941-7cf807424e2f", "comment": "Malware payload (Dridex)", "value": "aa1367110c93bc8b4019ce2158ca3ef8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120458, "uuid": "b3e324a8-5c64-428c-8378-8694e852a67b", "comment": "Malware payload (Dridex)", "value": "071f9035e5acd9ec7b741bfa995f3f7d308697d93d81106157e239f11545b59a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120458, "uuid": "aed081f1-4ee4-4e6b-9a65-b4490ac270fc", "comment": "Malware payload (Dridex)", "value": "e58a5ebb30e782053acddf08369534aef81d11ad", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120458, "uuid": "b5d26699-55db-4827-a8bf-135e8286cd29", "comment": "Malware payload (Dridex)", "value": "e6b4314d1e97f4bacbf10893607a275c9f399b7fbd04f3e47df27384b337464f659f94342aade07d1a4de07e6ea170a3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120458, "uuid": "befe37ac-b468-4180-aaa0-2fadec866d46", "value": "4414BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120458, "uuid": "447beb71-8611-4153-8e55-4fcd1e6c5258", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120458, "uuid": "1f6412f7-ea40-4911-8cdd-db5bbb1a2874", "value": "3072:83PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:4Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120458, "uuid": "398ebe9c-d768-4c41-9754-a18961dbe98c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120458, "uuid": "ff697bf2-830f-4927-b9a5-282191884e2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120458, "uuid": "6e76f952-dcc3-42a8-afe9-dd4ef4039f9b", "value": "071f9035e5acd9ec7b741bfa995f3f7d308697d93d81106157e239f11545b59a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384a70eb-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123109, "uuid": "d764af21-a753-48d2-bcd2-84c1fe588d71", "comment": "Malware payload (IcedID)", "value": "c565d005b3e39f19860cde9f11fce6ec", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123109, "uuid": "fef8a9db-aadd-4906-95fe-97effe1d677f", "comment": "Malware payload (IcedID)", "value": "072c80376261caa87677abfb9dfc268ef0ef49e1611c1c554368a3501231ad6e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123109, "uuid": "9ccaa46b-4ac1-46ae-a53c-101ff72d7291", "comment": "Malware payload (IcedID)", "value": "46b69746cc3a12493ccf5a5827fc454668cf4fab", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123109, "uuid": "58147630-e869-41be-86b6-85b00a4ce0e8", "comment": "Malware payload (IcedID)", "value": "a1bcc5c83730eafe4ce9de35d844c15c09532b0416dcd5d710e3521ac598183efdb44446e7e50aee476d2a3c99196960", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123109, "uuid": "0e3223fe-7b93-4a2c-bf16-cc1017383ba3", "value": "72B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123109, "uuid": "08957ff9-2efc-4c1e-996c-f8a2e5225a8f", "value": "3072:c2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:czxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123109, "uuid": "92741dd8-0c6b-4500-ba7e-ae1dd4c314d2", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123109, "uuid": "1db724b5-3d00-4467-ad44-8591b8e89688", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123109, "uuid": "da3cd369-e1b9-4a93-9a75-1a41d44b584e", "value": "document-603831581.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7998bd-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121584, "uuid": "3251d539-217b-47c9-aa55-728717cd4654", "comment": "Malware payload (IcedID)", "value": "ba0d909a00d5218ffb2c0789c7c7c09d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121584, "uuid": "7a6f00aa-2d7c-422b-9db4-3318280bae1d", "comment": "Malware payload (IcedID)", "value": "07416711289f9883509f3fbf833819dc893463a6e0a25a495d1ca5127fb8e76f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121584, "uuid": "709186bb-a625-4b89-a260-a8bad21adb11", "comment": "Malware payload (IcedID)", "value": "4611a0bf38913839fd6ce17e2cbc0df76fe49a88", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121584, "uuid": "b321bddc-fbac-4c24-93c2-a6d7c393ad00", "comment": "Malware payload (IcedID)", "value": "f4c4e06f300210392d847bdc00255c96bea26e60a699798ba8e4f5a5b6064c78c01afe99ea0c7a2f42cf2bc3fac8b786", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121584, "uuid": "6b84659d-a659-47d8-80dc-0d54740ea253", "value": "34B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121584, "uuid": "b21776d0-516a-4765-9e0f-caba091695d1", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121584, "uuid": "f4ac262c-d729-41c7-a908-66ffcabd48d1", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121584, "uuid": "ce1fcc65-1d11-4fce-b6cc-667e1fe7921d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121584, "uuid": "d83da81f-4cfd-45ec-9ac3-3e0c90a99d27", "value": "document-1120805359.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9cafeca-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127191, "uuid": "02aced0d-c0b4-40a9-bfdc-b2366f5fe8f8", "comment": "Malware payload (IcedID)", "value": "c61a546abd800e70340dd1dc4c159ac4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127191, "uuid": "1c2b8023-034d-4101-adbe-18c8837f1108", "comment": "Malware payload (IcedID)", "value": "07525ac6570d197f591696ba9a47c75f0f2a1b94d00e25f2a8f3695c971f77b7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127191, "uuid": "f6223b66-6ffe-4674-8200-6fd5d558f48b", "comment": "Malware payload (IcedID)", "value": "3b0c6b68ece36d383651933c4cf3e4acc759f086", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127191, "uuid": "0cf666f1-8114-4954-8d46-dff33b0711d6", "comment": "Malware payload (IcedID)", "value": "ebcae09204fd4252d0541ab3b91c67074d15db2cc27e2e3316ef910ca766073657078d6b8ae2849e3f019ab5c72c99c5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127191, "uuid": "d4e045c8-5a77-46d1-8631-37ea4ed3e4a4", "value": "C0B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127191, "uuid": "73ebd82d-7cc0-4604-99cf-5954f259e5fa", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127191, "uuid": "21e1d962-aa96-4bdb-a3f5-ca6acc5e16bb", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127191, "uuid": "3dee1869-f155-43d4-bab4-eaf84b33cb55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127191, "uuid": "0d995e6f-0f44-4b90-80f8-6e85bedfc02b", "value": "document-1536229199.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf2723a-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106769, "uuid": "1ec506ba-7f0c-4bda-9fbf-7cd3983bdcb2", "comment": "Malware payload (Formbook)", "value": "11403411d004910e724fe4cffed09288", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106769, "uuid": "615fe8b3-e6b6-4492-83ec-f49c30240153", "comment": "Malware payload (Formbook)", "value": "0757111159ca0d2941db3a8f59af8256faef71379b5af72457c8ec861c2ebaf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106769, "uuid": "a481b280-ff04-453b-922a-292d7229fa4c", "comment": "Malware payload (Formbook)", "value": "87887bdba8876cf47d9d96fc19830371fd7fcba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106769, "uuid": "931d7820-3c30-46d4-8207-9e667222afae", "comment": "Malware payload (Formbook)", "value": "776e53e2b56946111ad513ecef9b8c19e6444b43a11a1beab5d11983d7d456487b118e2a94a0705b7d546bd4f78ec079", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106769, "uuid": "51ca3f3d-4762-45ef-bb12-a1e9fc2bccc0", "value": "64D492A870AE805DEEB46634F5B555821FC969321F52FF3F28E66B002C63779F94E810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106769, "uuid": "e756dca0-c93c-45db-89c3-8408c39d70e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106769, "uuid": "641583c4-861d-4ba0-853f-3a7cce7fe97b", "value": "6144:hgpy7nAqrX/MLv45w75gX001/s9fXcGgU6UyOwoyTQ+1HYeFIlFKQm0umL7dov2m:hgo7AqrPMLQQWcfX6UyvQoQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106769, "uuid": "eeef536a-4142-483d-87f7-72365057c703", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106769, "uuid": "4709004b-2ff1-4352-8f42-4bdb369e7e5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106769, "uuid": "601274be-5d1b-4019-98d7-4a20eb516f45", "value": "PO_RFQ007899_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de904e1-9189-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617130420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130420, "uuid": "a762dc69-6d82-483a-80a0-b51bc0e4b16c", "comment": "Malware payload", "value": "84ecc0f2399b880a276bd6e1ffff983f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130420, "uuid": "d36b940b-a2e3-4fc6-8b3b-9d3e0be23fe4", "comment": "Malware payload", "value": "07fde17ae88dc862e37298371c23b447a5c3fc243419ea40209d57ec7986e5bd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130420, "uuid": "312bf740-1799-4beb-94f5-b6414c114ed4", "comment": "Malware payload", "value": "a5f67ffbb4fece07869695b8699e365b6beaa0d4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130420, "uuid": "0c151ee0-3868-4286-9bd9-abf7cad3240e", "comment": "Malware payload", "value": "8634e25301023d7ebb8e3b970a0ce49d99aad64f5ff017172ac82961737ab9976a6c24f9c4cacf58e18a0e1db0774432", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130420, "uuid": "c28b3b7b-59f1-4c1e-929c-75ad6904e62c", "value": "AA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130420, "uuid": "29379b62-7e33-47ee-9ec4-82c817ffc37d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130420, "uuid": "af381e8c-8a3a-4980-afe8-40b670b15c54", "value": "3072:p3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:BJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617130420, "uuid": "2b31c70d-dbab-4b79-b492-5fc201cbbf74", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617130420, "uuid": "8bcfd567-0352-48ba-a10a-dea070d23c08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130420, "uuid": "21a9b9c7-8a54-40bb-a774-6ac40b5d7ff3", "value": "07fde17ae88dc862e37298371c23b447a5c3fc243419ea40209d57ec7986e5bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c636747-916f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119170, "uuid": "24b5d6d5-68d1-46ba-8074-6f5b32e80a2d", "comment": "Malware payload (IcedID)", "value": "cd06884319fde181b5ea728a6c9bd8de", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119170, "uuid": "5957811f-2202-42bf-ac90-fd14da0508c9", "comment": "Malware payload (IcedID)", "value": "0822e66c016cc190cd63b8167d1c29ce19f7ef5ce7a73f28b9a39149c5812ba4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119170, "uuid": "8ba4f44a-afaf-4d07-bca8-bce4d1e5ee5c", "comment": "Malware payload (IcedID)", "value": "110893686cc72f8a543e43d09fe4f0bc5096d295", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119170, "uuid": "fdbfc0d9-db43-4c77-a0b0-8f99c5c9cba1", "comment": "Malware payload (IcedID)", "value": "3f2770858cb55de39110bcab34e35493a2890be23fc71cef15f7b56b78d143298d04f7c8ddf7d77394f2d5f828aa5cf7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119170, "uuid": "cd79e8ae-7893-4654-8911-146374d82295", "value": "4BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119170, "uuid": "cff39d2c-8746-4407-9736-015760f66e55", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119170, "uuid": "7ab22088-26de-4ae8-abd2-83f073dbfc77", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119170, "uuid": "1b58bfaf-e1cc-45f6-ada8-c1670ec3a813", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119170, "uuid": "09e7bd7f-4652-4f15-92f3-07ce474ae85f", "value": "document-842509304.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd21bc94-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617088542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088542, "uuid": "0336636d-7525-4858-811e-a2b890f1f2a2", "comment": "Malware payload (Dridex)", "value": "72bc1fccc975523a786a77283df0c783", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088542, "uuid": "69ec29ab-6ca3-4235-b638-6cff1b9cca7f", "comment": "Malware payload (Dridex)", "value": "0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088542, "uuid": "cf3bdb97-4370-4f7c-9493-a0fe9443bae1", "comment": "Malware payload (Dridex)", "value": "1ddd26c5a2771abc581449309df2a983873adb10", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088542, "uuid": "2a779778-2ad9-4c8e-83d0-12c7f126e89d", "comment": "Malware payload (Dridex)", "value": "b9b93acf026114e3d42504b7d174abbef5dfdd5a98d7d6d5ffd45c4c78cec8e800b9c5087ee4516696b6456a3fa16383", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088542, "uuid": "d8156343-2982-4596-9068-69dc0b9d07e1", "value": "8BC4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088542, "uuid": "5d0d74b5-2e80-4d09-9162-b5098264f0c8", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088542, "uuid": "9854a467-3e28-456c-aebe-1f65cc4bac9c", "value": "6144:9GiMOQpsduhD3AZHC/uNbExd+4UuwT1b0717WLmw6Xg6DqaIDnnlvgho5la:wVhDQZHC/uNY2/TRm8LYQOQlYql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088542, "uuid": "a2dd8923-afcc-437d-889f-dbc9a7443c35", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088542, "uuid": "4f0cc4cd-2fe0-4b94-b63e-d46d22f1b71b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088542, "uuid": "5c16964c-6da6-4903-a851-ace11fec7223", "value": "0858efd4b52af5410f15e4007d93c49e3fedd7523da5ccf89a5624be016a7ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7aa851-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617133157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133157, "uuid": "4e678255-a1ea-4982-adbd-4f17073533dc", "comment": "Malware payload (BitRAT)", "value": "6058fc9b3955abbdb041786a3d9e39fd", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133157, "uuid": "96d4de33-3cb3-4658-aa14-bd0ac26703d0", "comment": "Malware payload (BitRAT)", "value": "086292a6bfd70867d0186a92add0deca164c0588fc37c30c4401e249c2b59257", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133157, "uuid": "c9b1aa46-c24f-4e89-a6bf-8cddacda7ce7", "comment": "Malware payload (BitRAT)", "value": "b649bf868ba6b6af9e188a12d31dbf9d441e686d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133157, "uuid": "c4b7b243-6010-49ff-889f-521aa09f6b7f", "comment": "Malware payload (BitRAT)", "value": "c5bc15af2827ffb673c6e5cb8b1a2d7b4191efcb4c64758e0ede3021feb3b1179e0c5054e0a28c939fd2aeb77ae46ae2", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133157, "uuid": "6b108065-e92d-4fc2-8f2d-b1900a6cbbdb", "value": "D51633887FD86828E3D1797A4FB6E5F81730BD1C5A688662B0F56F8B7BFC2471054602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133157, "uuid": "c5736d3a-611c-4ea2-a33d-70553979bf42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133157, "uuid": "de804701-2636-4fed-b3d4-cd19c885b63d", "value": "98304:Zx36ypySjmBut47ueu4DzgblXG3M8K/F+gIakvelQCJn:L6NSKBuIue/E23K/F+5GQCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133157, "uuid": "3523b60a-4cad-4d55-990a-9101249291cc", "value": 4043480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133157, "uuid": "a77edba7-25ab-4d87-b6eb-78ea202a1dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133157, "uuid": "145a58dc-8baa-4ea5-a65c-7054ef2e0f49", "value": "6058FC9B3955ABBDB041786A3D9E39FD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331dd169-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "29fcf2d5-af3a-4b70-920d-cf1d36e93d35", "comment": "Malware payload (Dridex)", "value": "acfee463d9bcb5dd21af4b7f418f106a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "5e09e71a-8b9a-4697-a830-4c26579e04d4", "comment": "Malware payload (Dridex)", "value": "0890704eeb1e33f400a25d0bae2031bceabc8912ae247f3ce964c7631e85238c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "5a156558-e378-40a4-a768-b4ef08c9da50", "comment": "Malware payload (Dridex)", "value": "4887030ef9c79591352b86e11353afa04192a959", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "b9227553-08ba-4c9b-bf68-04b8d9bbaee9", "comment": "Malware payload (Dridex)", "value": "6e3dfee3199d3c79cf360360ca366ec53abc761787e76653479ff914d2f30d288e92a38dcd2a913c9be86b6ed8bc7e41", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "ba6d52b0-e265-4072-8faa-6c5b6dee1410", "value": "C314BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "1ef6ec24-54af-4a88-b67a-b5f3afaa950c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "e8878389-26e9-497c-9adb-1bf573084f94", "value": "3072:B3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:ZJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115369, "uuid": "a4ec483f-8a3c-463d-b488-62714f25b532", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115369, "uuid": "d40532ae-7b7f-41f6-b260-da232f03ae19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "f2bcb4df-5037-4981-becd-7390ad3b36d7", "value": "0890704eeb1e33f400a25d0bae2031bceabc8912ae247f3ce964c7631e85238c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da96b3d-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143760, "uuid": "5962fd6b-5b14-4119-8812-b970e5567b69", "comment": "Malware payload", "value": "52494e7355040b7137dc853eeca5826b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143760, "uuid": "0450c772-097a-4865-9248-c13ec5c273dc", "comment": "Malware payload", "value": "08980f0484399835bfdc0d1d17ac8d063ae5749e91eac40e7ec71423629087be", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143760, "uuid": "4c982088-05cc-4cff-963f-beceed5fa0b0", "comment": "Malware payload", "value": "cf72649c8333fe9c5d5d6a8cef79234893279cb9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143760, "uuid": "d5dc5abe-9497-44ad-b91f-41d1c704c09b", "comment": "Malware payload", "value": "2bb45739eae9ab657b6f610672ef9f74bfb58d88de7e8085b9d36eb609338358d0f9f8fac97fcdfe4c70e3eb2f05ce82", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143760, "uuid": "3be95d87-9a81-44c9-abfa-a17b46f7e953", "value": "B914BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143760, "uuid": "d7ba6592-9f45-464b-958b-78c8251018cb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143760, "uuid": "6d325cd0-2538-4746-9e8b-f43d52af4c92", "value": "3072:a3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:eJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143760, "uuid": "488569f3-57cb-44ac-8859-bdbfd6be748f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143760, "uuid": "0262227f-7043-4e36-b062-feac36530b1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143760, "uuid": "bc8a8f3d-6bda-49c8-ac4e-f9a51d81e800", "value": "08980f0484399835bfdc0d1d17ac8d063ae5749e91eac40e7ec71423629087be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d432cd0-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131680, "uuid": "a02d28ec-768a-4677-ac8c-8d3dc3dea9b4", "comment": "Malware payload", "value": "43c6196cb7021684750ed1c48dbf3be6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131680, "uuid": "9a54ecee-ac1f-47c7-a08b-c0ece0753f91", "comment": "Malware payload", "value": "097ae06d02b0efc792709a69cd339d06cb49e5594d6a5d2973a0081a7d644e9a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131680, "uuid": "b3a70dc7-7c18-4c5f-ac73-86800e115f85", "comment": "Malware payload", "value": "85936be828c7aacd251274349dc84fea610a4b91", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131680, "uuid": "d9d1f64d-5fca-49ef-ad62-7b9cb793c874", "comment": "Malware payload", "value": "06c227754144c3fa95a2e22d6c1776d96298c2d05c48039c81f8bff7bf570cc4d7b3b0e08bb407b33afd2439a92a3cb1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131680, "uuid": "9d0901c7-8cc1-4bba-ac8e-d06449a4c19e", "value": "0A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131680, "uuid": "3694b24e-c30a-4029-8af0-e0b84d81b2ab", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131680, "uuid": "b0335ee3-df23-4f35-b5de-3ccff8c7cc0f", "value": "3072:w3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:UJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131680, "uuid": "9d737750-60f6-4a94-a134-eab038262772", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131680, "uuid": "b6c38d8e-f5ca-4303-bd18-89f7ed8554cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131680, "uuid": "94eb4519-8262-4175-b964-d63031658cb6", "value": "097ae06d02b0efc792709a69cd339d06cb49e5594d6a5d2973a0081a7d644e9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1fd685-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "bc5b0e11-69ff-46b4-ab46-37113c003b22", "comment": "Malware payload (Dridex)", "value": "bd9c9f050d5752b19efdd5cf00047406", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "a014e5ec-1162-4d6e-9306-ab21df813e81", "comment": "Malware payload (Dridex)", "value": "09e2ff48c1e3cc29c0b85b96b48319ed6f72cbc56a6e529dd2dab8aece312f06", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "160e028e-18a9-4009-bbc2-a32925514ee0", "comment": "Malware payload (Dridex)", "value": "69a1c403614dcfbe067dd5f85a75501c33058980", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "ec1648e6-9edd-41a1-8972-d100bfdc33f3", "comment": "Malware payload (Dridex)", "value": "d32ac2db8dcc62e89d60e70c6e0700438082dc44f6fe085ae64225c9b48dbf6712d322c93ac186b1c682f6659547fa00", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "e57d238b-a8ac-4353-8678-9714e04e15f0", "value": "5114BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "68d04b1d-8867-4fc2-b76d-a924b5dab545", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "9bce4907-b757-487d-93be-c0d216541574", "value": "3072:q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:OJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114393, "uuid": "f0a0965c-02e7-4408-98dd-4dc06bee4f73", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114393, "uuid": "6cff6f47-d769-48c0-b249-dd84fd3e0035", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "17b619af-8ff8-451e-9649-14cedbf32be2", "value": "09e2ff48c1e3cc29c0b85b96b48319ed6f72cbc56a6e529dd2dab8aece312f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52151f55-917e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125729, "uuid": "a62d2c53-1236-400c-ae78-79d815319a19", "comment": "Malware payload (IcedID)", "value": "4f40016fa439574c15cbc31dba0b8aea", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125729, "uuid": "26235f37-9233-473a-b5f6-3405590e776b", "comment": "Malware payload (IcedID)", "value": "09f126a58d3ee0b7f548732a54b6b160ae1581b69ea78b1f4c220c5e0bb63200", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125729, "uuid": "a5510719-44a7-4bd8-93f6-735c9a2e74ee", "comment": "Malware payload (IcedID)", "value": "4f5654ce9ace518dd267df248bf995fc07a39bc3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125729, "uuid": "fb22a5eb-94b9-4f99-8e19-e4809404fe91", "comment": "Malware payload (IcedID)", "value": "cb5184a994f85b4d3da5679a10b15fae9f532878d6f0916055336f8d34e92f2a44fd073383d3c843879aeb6b3ebd9cb0", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125729, "uuid": "7395468a-bb4b-4aad-a4cf-948aa9754114", "value": "06B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125729, "uuid": "b74a5d4b-6de4-40bd-917d-2fa8f3f14e19", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125729, "uuid": "04efb0c0-8b12-4ee3-8022-51a96f323cb7", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125729, "uuid": "373a8536-f221-44e7-a14c-c21125c7e712", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125729, "uuid": "e35b674e-e628-4e50-9634-4ce983477428", "value": "document-1540585366.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9c09ef-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114100, "uuid": "bbd972e8-8544-42ba-a21d-9373f0f0666b", "comment": "Malware payload (Dridex)", "value": "54f4cf6c1dace64b72986e7dc0050243", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114100, "uuid": "710822c2-7e2b-4266-b5a8-754778565e72", "comment": "Malware payload (Dridex)", "value": "0a3626535bdf2d7dc02d180e55a4bf10c5788fc12e3891bbff7f809cf5e86374", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114100, "uuid": "c2a65c5c-0c11-44f1-9dac-0e6c2960d520", "comment": "Malware payload (Dridex)", "value": "70d28e5baee29edbcee07d0f076a94d3f6c2be0c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114100, "uuid": "6e1f7429-7857-499e-bf68-3cd0e77e1026", "comment": "Malware payload (Dridex)", "value": "54e36cda1c8d9d07e3e89f7a0481f94b8720d55426fc06e32884d5d94c282981f687492df0ce67257829bf9aacb15302", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114100, "uuid": "6090da24-8eed-4460-85dc-0e65083292d8", "value": "8614BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114100, "uuid": "de3093ec-b359-4837-bef1-3fff3be4d200", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114100, "uuid": "907a5c7e-31ed-4564-a30e-e99e1857f597", "value": "3072:N3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:tJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114100, "uuid": "b317c471-7be5-4587-8c95-e778a7edd8a8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114100, "uuid": "f3ef641a-6d2f-4336-a68e-00b2d68996c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114100, "uuid": "84293f4f-b762-4ad4-8972-5990b92092a9", "value": "0a3626535bdf2d7dc02d180e55a4bf10c5788fc12e3891bbff7f809cf5e86374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb9499a-9193-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617134905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134905, "uuid": "916bfe6e-35ca-4f2c-a5ef-ab989ed53a41", "comment": "Malware payload", "value": "26a5b6c429e95b2a893c4f36b8ac6a7d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134905, "uuid": "6471092c-24e9-4d43-be6d-c05a0a9e4f05", "comment": "Malware payload", "value": "0a402bda1a369616a5bb1b95e8bcf8f7760423b76fc361414a02f17d73c3a687", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134905, "uuid": "877b5b24-9905-4228-8806-754aacc63991", "comment": "Malware payload", "value": "29ad1353c2980b3b3c123994fa16a84183642a29", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134905, "uuid": "0310f1f3-85ac-4e5a-a191-b7b7bb0fa453", "comment": "Malware payload", "value": "fad1e144fa45f618405256bc95f26804a5d60dd636753153866e3ca67fa94233f466a31b3e0c5bccec909a857134f1fe", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134905, "uuid": "a756529c-faee-4713-b9ae-16cecbe23f8f", "value": "8E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134905, "uuid": "3f225f50-88d9-4372-8951-abbf2e73c2e7", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134905, "uuid": "8353d80d-f197-4e25-bd2d-84d4f6f28098", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617134905, "uuid": "1a1f00d3-8982-42af-bc27-6f7ccc14e6dd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617134905, "uuid": "868a5b47-6407-4b55-8ea0-10ed29bb2fdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134905, "uuid": "7dc687c0-2892-4062-ac09-df5e1b18a4d0", "value": "0a402bda1a369616a5bb1b95e8bcf8f7760423b76fc361414a02f17d73c3a687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e2d0da-9159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617109869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109869, "uuid": "aedcb90b-ecb3-4858-bf76-a8b450554dad", "comment": "Malware payload (AgentTesla)", "value": "9dc4697c66965226285dd0d8d78813cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109869, "uuid": "f168a84a-f2e0-4048-a35f-6bb25cf3d4dd", "comment": "Malware payload (AgentTesla)", "value": "0a557f081ebeaf7d454df6e0887fc4bf30740696c28e804bf13cf6b89fd5ed7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109869, "uuid": "34480a57-8fb5-4924-84af-942e74a31a1e", "comment": "Malware payload (AgentTesla)", "value": "7fb738a754c451fbc6fb5cc7b1c0ddbaf385985a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109869, "uuid": "f7c94150-2a18-4fd2-aa98-02da89b649bd", "comment": "Malware payload (AgentTesla)", "value": "936f35a594d884a5bce9e0a5752011cbc9b48cd78afcdcd1ccb00dce9728409960bee6791b9447434d698575af7a1dd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109869, "uuid": "f5252910-4684-4a2c-bc9e-8dd545f343a2", "value": "EE0502B038A8DB84E72D57FA5054600047B5E7E62023DB5C9DD8E4FE246EF8C4ED5A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109869, "uuid": "21302296-4a6e-456c-a722-f969da2c737e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109869, "uuid": "e5e3e8c0-8282-4ca5-a050-742d749e8965", "value": "12288:DQSzhLIC+WPAYPXtyrFpn9w3P+fNOT7sBifM5jfT68v2CUVZh:L2C+WPAYPd8pnO+N6fM5j768eCUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109869, "uuid": "8e468139-c697-4eb3-a48d-110f2ce5aaeb", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109869, "uuid": "59dada07-b28e-47ce-a053-c30c8938d743", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109869, "uuid": "1ec85437-7cfe-4d0e-a52c-42592e052a15", "value": "PO-8372929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea1716a-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120086, "uuid": "4f9a6dbd-84c9-4edc-94f4-bbb1bc650947", "comment": "Malware payload (IcedID)", "value": "2d4a16232a0b941448c11cd5ae79c4e6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120086, "uuid": "59707a27-5199-42aa-b20d-3345dc9f81d7", "comment": "Malware payload (IcedID)", "value": "0a6b89560c76fa55f2596f6097c2b93ffae325c18044e533cd35128753d06649", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120086, "uuid": "8e3fc48f-ab4f-4801-9442-e9c884888497", "comment": "Malware payload (IcedID)", "value": "a00893ca2c72a885a96eabd4cda3335499adb41c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120086, "uuid": "cc191369-dcca-4543-a9ef-0d98aa09a234", "comment": "Malware payload (IcedID)", "value": "1e376b3a0ae3501cde719e0ba4bcc9c78ae117d1a6049445726a713aed9362be50944f9b01e0bed183921b5b4c84855d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120086, "uuid": "5dcf1580-fada-4bef-82c9-24702ee8a9d6", "value": "BCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120086, "uuid": "25aef5fd-4b8a-4a56-b8e9-0b110c405781", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120086, "uuid": "2fd93a2e-7a97-4849-a732-113a288a0442", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120086, "uuid": "42145aa4-9737-49c0-aad6-594d25946199", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120086, "uuid": "235d0489-4ca9-48fc-892e-ba145025cb84", "value": "document-159442525.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446c63b7-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1617088340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088340, "uuid": "21084b16-0a7e-4ee3-823a-dcd683c29f9a", "comment": "Malware payload (Amadey)", "value": "ee90ec5ebddc940e44d7ce7ef39b6a7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088340, "uuid": "6d22f262-4820-4de3-8f7b-a721514feaae", "comment": "Malware payload (Amadey)", "value": "0aab43b526e9c5c16eb0d285a6c1c50fba4c750a23020234f3c1a8d329074b6b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088340, "uuid": "1e7a3fee-7f8d-461f-b43f-39081ec76552", "comment": "Malware payload (Amadey)", "value": "8528db20489a542fea6e29c214418fba5a93a2ca", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088340, "uuid": "0410ca85-a2a1-4ef3-a9be-f36791d4f1d1", "comment": "Malware payload (Amadey)", "value": "fa7a0acb528acf77a329298970e0d7ceb8276a8294b237b4a7df7182e3c3e3bfea175ab741360683afd41b42214ef5d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088340, "uuid": "6f3faf60-55d1-4d6c-9a48-eecf35002f4a", "value": "E044CF11B6F0C433D556093A4825C2A14E36FCB19F3496CB7BA43FADDE612D28A3A747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088340, "uuid": "f5263106-b1a0-4b87-9899-29fa6640bcde", "value": "934b2a7810abd400bb9e54d3d6394b07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088340, "uuid": "0dff1d4e-9657-4098-b7ce-ffab44f4ae16", "value": "3072:sD2evyyqRVkbRjQLQeD5xCINceRFm/FL9d+gCS9fdlPembvMSSTZT+cXEA4UqBH8:E2Io4dQLDxfCgG9G+lL5iJ+e/qwRuKkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088340, "uuid": "56047f11-e930-4235-8196-affca30b2af2", "value": 266768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088340, "uuid": "ff845982-b147-40de-80fb-e56b4404e1f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088340, "uuid": "cb0f19b6-286c-43bb-a9a4-6380d21aaf0c", "value": "ee90ec5ebddc940e44d7ce7ef39b6a7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b70104c-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120269, "uuid": "0034486e-15f2-4b0b-ab9e-2b93f667e88e", "comment": "Malware payload (Dridex)", "value": "d74c1f6347fdbe541e529117aa9a630b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120269, "uuid": "d17e684d-aa24-40f5-8680-39d9ec7da86a", "comment": "Malware payload (Dridex)", "value": "0ac27485550638cb4ad1649a28364b3d625d48a70296d8844fc730ad415c268e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120269, "uuid": "8bc74005-720b-4daa-9ccb-aec823cebfc6", "comment": "Malware payload (Dridex)", "value": "ea5cc881e141d82bd38802b10581f366f947fe3d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120269, "uuid": "41583dc2-580d-473f-ada0-dcbdc871b73a", "comment": "Malware payload (Dridex)", "value": "80c015f832aca690629801c5a75ebfb6dd7c56ea402f8fc12b3d19e079deccefd65dfd129882a6d3a58d15750207536d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120269, "uuid": "20e56174-351d-47fa-aa0a-da98d40163e2", "value": "7E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120269, "uuid": "bf5ad9d9-c041-4a4a-bec9-8eddde68ddae", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120269, "uuid": "fbb5131d-4d0f-4f4c-98ec-622a006dc2c4", "value": "3072:n3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:/Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120269, "uuid": "78aef184-75c3-4548-8bc1-1069b2539247", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120269, "uuid": "a698eb05-2efa-47f7-a949-e120e1da84a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120269, "uuid": "c2dd057f-da03-4cde-9df5-e743bed8941f", "value": "0ac27485550638cb4ad1649a28364b3d625d48a70296d8844fc730ad415c268e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617850f9-91a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144223, "uuid": "aeaaaa02-abe1-4a67-99a1-3a4693321c47", "comment": "Malware payload", "value": "ac43db56b832b089c72112651c676598", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144223, "uuid": "11f98394-9f49-4b46-a52d-b429d3fcb9fd", "comment": "Malware payload", "value": "0ad9459106b10b21981d28af6d82953c009b93848202b249cd3fec96f88c7575", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144223, "uuid": "8bfa010b-7835-4cdc-bbc9-364d7e87e3c8", "comment": "Malware payload", "value": "27f270f447f2ce442502ac3c05ea320d878fc669", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144223, "uuid": "ca567a55-c63f-40dd-be88-55ee40802fa4", "comment": "Malware payload", "value": "975a2c7937db4d9ac8842ac6a7dbe885a6836320d171fab2d4effd0d11764cfbbcd3a4cae9b9184250214cc6329bdb51", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144223, "uuid": "000b2520-4349-42d6-9002-c6a309130492", "value": "9814BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144223, "uuid": "f44f0f5e-3b57-4974-ac66-4daa0c7caef0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144223, "uuid": "b0f213b0-829b-4a31-931b-03133899d338", "value": "3072:23PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:yJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144223, "uuid": "2e2b8905-ca78-4778-b31c-a4f10cbb0973", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144223, "uuid": "cf623db9-2167-4fb1-bb7e-c01ba4a06a93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144223, "uuid": "91ad8719-17dd-4df4-bde4-0e843febcdb0", "value": "0ad9459106b10b21981d28af6d82953c009b93848202b249cd3fec96f88c7575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cad2104-9188-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617130095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130095, "uuid": "522e142e-9375-4301-9db8-f8f4089d444b", "comment": "Malware payload", "value": "5f12bebf6281a42cdb7c1676db5cbfb6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130095, "uuid": "e40d023f-43cc-46ab-b0da-d1aae6d12920", "comment": "Malware payload", "value": "0ae93cfb88bc54d584d46f6a90e8cd96b2c8e668e6410360db1f9477b0aae26b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130095, "uuid": "f3a59ab2-b92d-4450-a7ba-ab6f3d68c140", "comment": "Malware payload", "value": "dde874e54ddbb6e3d8d4ba21b0f163ca58ccd978", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130095, "uuid": "bedd6a79-3087-4141-93fd-b0f193bfaac5", "comment": "Malware payload", "value": "4c9dee5763f3e611e91074aa5e2ff72599c8328abf8accbee484161f0858bb2ef88dfed0394a7b266ab0bd2b2ab702c5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130095, "uuid": "8b5adac7-1449-406d-810f-e7876aec8f3d", "value": "A614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130095, "uuid": "672f866a-d0cc-446b-887c-506bfe95a0a0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130095, "uuid": "cac06fe3-a0ad-40d1-a3d2-d3c11f839816", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617130095, "uuid": "71e7d51a-fcd1-4e0b-8f7a-10c636333536", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617130095, "uuid": "ee81aa3c-4c7e-49f7-8932-201159b05ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130095, "uuid": "4db45272-3b48-43cf-af17-0906b9db15c7", "value": "0ae93cfb88bc54d584d46f6a90e8cd96b2c8e668e6410360db1f9477b0aae26b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1168961c-914c-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617104146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104146, "uuid": "feb15f70-6d5b-4eb7-9f86-ce8cbf030ffc", "comment": "Malware payload (ArkeiStealer)", "value": "e23f866ca571b881780603c4fe02abcb", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104146, "uuid": "837fb584-a8c2-48fb-90ba-4c2e29466460", "comment": "Malware payload (ArkeiStealer)", "value": "0b02739c5fd7a7fa53410bc2287c42cf66a3a6d51ecc9570e76e4f0f8129f2d7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104146, "uuid": "fd9f2083-8b33-436f-9e11-c909997a225d", "comment": "Malware payload (ArkeiStealer)", "value": "fa6b8e5b0a3e12246c42e9896206fc14ad5bab3a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104146, "uuid": "ee7fbc26-6363-4599-ab71-01757e1caaa4", "comment": "Malware payload (ArkeiStealer)", "value": "5c66235d217396211b5f7fa312972bae76e1df44380bac43b77f05afe3cf6372e45cf6f99b7e90d60e74a460e4c3f4cb", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104146, "uuid": "62206443-5c6b-4a4c-bbc6-0300096ee355", "value": "A045012BAF7A0516F08105B15A9499F35B7EAC337292AC1FE7439E0810E1686F8F1777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104146, "uuid": "635b8c32-cf25-4f57-ab48-0ecbdc647fee", "value": "4eeb7c063177f859747f2bc33e9f870b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104146, "uuid": "92ed6dd1-5165-40b8-9356-69829d415852", "value": "12288:VfXKDZ+P0rMoV1JsOs8tEDO7y8xL9WFoHLBVfeg/fXvf0JoAXtUrAWacPfXf1my5:xK4PWB/sf8iD78xgIvf0JICiNcSkCVCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617104146, "uuid": "de35b21c-12e4-42a3-acf8-2d5c5c72f6c8", "value": 1253376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617104146, "uuid": "63ce3142-0600-4149-8dab-f573dd6d8475", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104146, "uuid": "e6f75a20-9bc8-4caa-ac04-0ed1e4b1a234", "value": "e23f866ca571b881780603c4fe02abcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9b0494-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126611, "uuid": "44ba1946-e302-4bf5-b1e0-3c737d23a458", "comment": "Malware payload", "value": "44708eed04662f3da140978bee7345f7", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126611, "uuid": "7ed4f684-833d-46ba-946f-b08f3a20743a", "comment": "Malware payload", "value": "0b841b6c25e00f18b0bf1b46762be9653bbb7e3477e043c94905acddd56bad58", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126611, "uuid": "e60cf5e5-8f3e-4fdb-83cf-4ff8d92824d9", "comment": "Malware payload", "value": "e8b072a6faadf6e45804c53233284089520c0434", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126611, "uuid": "6e5fc6a5-72b6-431c-90c1-80b1f32a1c2d", "comment": "Malware payload", "value": "337c44ad5a80d738017697af0ffa2df3d6fa6fc65d76ccc7aaf223bd3450c1fe2c97e31a2c3ba7a3c4361ddb1b26d392", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126611, "uuid": "122c9ba7-080b-447f-ba4f-3867675ca3c3", "value": "28A3E0CE22947D0FE7CFE63F6943F4EA1D634044E225B13F2578BB0951A921B0F4A699", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126611, "uuid": "6de1b68b-9705-48c5-9dd8-3baa712475fa", "value": "1536:cwTsRGZv1w/+VAOucniGlvKOYhTv7xVMsigZEQNggMorCKgHCJ5Nq:cwT+GZv11eGF9ETdV/vEQSlcCSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126611, "uuid": "1886541d-e72e-49de-87bd-afd559d8a096", "value": 101777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126611, "uuid": "d7d66dbd-f7ec-4cdb-9295-0b720a95f889", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126611, "uuid": "9e9668e8-f089-4c41-98a7-27b27807750d", "value": "operazione_972.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9f8ede-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120890, "uuid": "e7d93335-529d-4870-811a-407f8811d0de", "comment": "Malware payload (Dridex)", "value": "2a3d019e553c0661dda5bcb7622cacba", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120890, "uuid": "41fa2c74-7dca-426f-a155-b14119a000b8", "comment": "Malware payload (Dridex)", "value": "0b94184f9b149cd90fe287695a3aec01f6cc77381e2cf53ee111f4e7758d1425", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120890, "uuid": "083105f6-39e9-45a2-991c-4845e238103d", "comment": "Malware payload (Dridex)", "value": "bb86a87095391ed9970d8f5d13565ef06d8bfa29", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120890, "uuid": "5a3d61d5-ad17-4134-8ecc-507ff80be0de", "comment": "Malware payload (Dridex)", "value": "bd2087ae4aaa6632edefbfd466f9ad65f3e18e81f2d6349cd1a9848879e66bcaf38c9cc29b37589484941ed720c220b1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120890, "uuid": "f806f963-e3a2-4dcf-a9d4-a10fb49eae27", "value": "7D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120890, "uuid": "5e4fbc39-e435-4b14-a329-4d81d1201cd0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120890, "uuid": "e94f20df-706d-4fb9-9b0d-1c331e46187c", "value": "3072:L3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:LJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120890, "uuid": "e2a122fa-3fd5-4659-8d96-571c65264f60", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120890, "uuid": "0b7c6593-a4be-474f-b8d5-f1d917c4e72d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120890, "uuid": "6c4e661b-2ca0-4766-b87c-77af02df0e0a", "value": "0b94184f9b149cd90fe287695a3aec01f6cc77381e2cf53ee111f4e7758d1425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a5841e-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114091, "uuid": "29963f1d-da1a-4b2d-932f-a35b2ff2dba6", "comment": "Malware payload (Dridex)", "value": "b6a1b8a8404bdd4e92717a9ee6c19915", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114091, "uuid": "61467ad2-c213-4f35-be40-f2c352f9b98d", "comment": "Malware payload (Dridex)", "value": "0bb39885103b3bb56273776e5a6235098ac277bc02652d098c1a2228acd496a5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114091, "uuid": "ea82161f-46a1-448b-8ab1-1f301a575543", "comment": "Malware payload (Dridex)", "value": "e6f7fa1f59849d462cedcbf2e7b0a889fc48a0ee", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114091, "uuid": "929efa5f-24aa-4ffb-87ac-4f9b5d977aa7", "comment": "Malware payload (Dridex)", "value": "e8ab4736c8af75ec01f599beb19e3d77823c22fcf2315fa2dae936030b3b05d62c5540300beca59e8dac01d935176fee", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114091, "uuid": "345d0ed4-8a5e-44a9-8d18-3816d6d31eea", "value": "9E14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114091, "uuid": "e169c4a6-b693-425b-91a3-5838d83af514", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114091, "uuid": "44aea1b1-74cc-42d6-b9d1-e13b57795ed6", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114091, "uuid": "21e9ddec-5723-4d39-8586-c1691e0686b3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114091, "uuid": "e695b2f1-6a78-42bf-a6f8-cb92aba8ab56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114091, "uuid": "93cb7d48-bcaa-45e5-9c52-176cf0fd3a85", "value": "0bb39885103b3bb56273776e5a6235098ac277bc02652d098c1a2228acd496a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1199c473-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122185, "uuid": "4972a24a-1663-471c-9058-4bd25500ca6e", "comment": "Malware payload (IcedID)", "value": "ed010588d2891f174adac62dce61a559", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122185, "uuid": "0f817b39-c034-42c3-a79d-fdcc448eeae3", "comment": "Malware payload (IcedID)", "value": "0bcf2c56c5d3a2c17d1789ac4f3e22b43279957864f30170183e235fa555b4fc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122185, "uuid": "837316d8-7379-4a78-9e0f-54007f724ae0", "comment": "Malware payload (IcedID)", "value": "bd5fa23d29f40003576324b26e4482741c5bea65", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122185, "uuid": "fd815095-2ec8-4759-ad70-a937a3a24385", "comment": "Malware payload (IcedID)", "value": "7e4dcdd3fa2ab1375afa46ba08f06c1288985604af9f44f20b6107f27e30674ce45687332591cec97db802e476ced330", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122185, "uuid": "bc06566d-75c8-4c3c-a1e2-8350d765b95f", "value": "40B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122185, "uuid": "836cfd75-ac20-42c8-9138-6a2d337290a4", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122185, "uuid": "be6cd21f-977b-49b2-9ced-61cc28d54532", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122185, "uuid": "3ea51457-aecb-4fa7-af93-21063bbfe56a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122185, "uuid": "71e06aa9-5ab0-4fe2-b9a2-a82d12a4ab7d", "value": "document-1508886648.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f1b005-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143643, "uuid": "2a5973f1-537d-4fa3-ab45-b3d436cf71a1", "comment": "Malware payload", "value": "26795c6abcdf30533597b78a1afba293", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143643, "uuid": "1d01e035-d726-4247-bf93-12bdebb9be8d", "comment": "Malware payload", "value": "0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143643, "uuid": "d8efc0e0-664e-46a8-8816-efff0162d304", "comment": "Malware payload", "value": "1b915218108640bf8f35f2a568cd510077cb5281", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143643, "uuid": "d749f629-9384-4934-b0ff-40a735813d6f", "comment": "Malware payload", "value": "0be27a7bcdc22a298e8bee117d9bd04112347ee0e48dd5bdba16b9b50e616d6d0317a9345fa26a0053e58b1bc6eb0450", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143643, "uuid": "7140bf68-7134-40ae-b7d9-1bfabfcb7492", "value": "FCC4AE12A5629039F8B347B689FF594945AEBE90073464CB73C8996D5B7BAE03F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143643, "uuid": "8c478e35-e8bc-49ea-a8b6-44acec52f021", "value": "adeae1388ccab7d5ea2c08a636428844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143643, "uuid": "e787ba7e-6366-4810-97c1-da84b753c300", "value": "12288:hbHAqgIuNsQBUXGlXA21Sp3vykrYIwtUfd+G+CkZ:pBCNrU2/CakrYIdZ+rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143643, "uuid": "3a7d9beb-a9bf-4ef6-9cfa-cc5af1c21cfe", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143643, "uuid": "379ac1b5-0818-48dc-97c3-9932a3384f98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143643, "uuid": "d1e10c7c-8160-41f1-87ee-5a36e38d53c2", "value": "0c197468076c14f7b6c4fd095009ff628970f2c8d408131f7afd306b5e65eedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c61706e-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115304, "uuid": "44d40500-272d-402d-9698-6fc7dab38c38", "comment": "Malware payload (Dridex)", "value": "28101ec00cf8c6722db8c14e5a7dd197", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115304, "uuid": "8f84b377-d200-403f-9656-7ffcab4a63f3", "comment": "Malware payload (Dridex)", "value": "0c1a5d6ec22acc25117f458232b843369e37ab7393659b7aef3c6f9993e4b0b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115304, "uuid": "96ef2a6e-cccc-4bc4-a884-f42b6afa0bde", "comment": "Malware payload (Dridex)", "value": "044c90f93872701a09b1558a840b88e84122af68", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115304, "uuid": "156245b7-d5c5-4051-a0ef-8b10749dbbd8", "comment": "Malware payload (Dridex)", "value": "6a9b4df0741ed2934c7b59fd9956bfbf5c3cabac4c82b2dfa74773293784580c8ee4880ec6b1f8ccf61be8f33b4d799d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115304, "uuid": "9009a6c9-3c1c-4884-946d-e3bf229b56d5", "value": "9C14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115304, "uuid": "ee73e1de-f510-4449-b39f-8a7680216675", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115304, "uuid": "e7608ccf-e1d3-4774-bbd4-99b133f415f6", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115304, "uuid": "aa6a1c25-06ac-46fc-9b1b-ecc97af3841a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115304, "uuid": "f8e88223-bb05-456c-b620-b40898f22aad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115304, "uuid": "33f3c3aa-b9dc-49ab-b807-395bba1c7028", "value": "0c1a5d6ec22acc25117f458232b843369e37ab7393659b7aef3c6f9993e4b0b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af3d689-9112-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617079412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079412, "uuid": "744a1640-6ef0-42ad-808e-595335a5e0ee", "comment": "Malware payload (Quakbot)", "value": "a65cdaeee33258135e1a6f4721d3c597", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079412, "uuid": "4d0d5738-a2a3-4bcb-a502-04c2196f23f9", "comment": "Malware payload (Quakbot)", "value": "0c4068936697d08bcfab6ef4ed9ea7f73900170073f99a9ef5f173da3bc1a42a", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079412, "uuid": "9a034edd-ba6d-47b8-80b1-fe9346233da9", "comment": "Malware payload (Quakbot)", "value": "9f5f8aa3f1638505341bdc24f3c189ad1343cfbc", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079412, "uuid": "85d5a51d-7f1e-4cb4-914e-6f905ac5d41d", "comment": "Malware payload (Quakbot)", "value": "7cb30aaebbf49ef1e3c9f31ec84edb338a3b14af2d35384292724fef360db793c8f2f7307908352d528ff21e520e91c8", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079412, "uuid": "4d69bafc-60d9-4bc6-94ba-1dd3d5a694d1", "value": "55B3E19F7284B90EE74FF93E5546B9E71C174041D226B23F38B0BB0A959928B0F5E48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079412, "uuid": "c6914af2-5d12-46c2-b4d4-832178e9cbd8", "value": "1536:Mlsb7Dxs2Q9S/ULTv7xVMsigZEQNggMorCK/49dpaDw2IsN69B:MlsFjwTdV/vEQSlcCz9CDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617079412, "uuid": "f4b95620-c744-43f2-bda3-e951f1b8923a", "value": 107472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617079412, "uuid": "b2a02454-fe61-4f5e-be51-8916b2822d52", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079412, "uuid": "6b6a5240-e053-4491-91fa-ca53dc90b835", "value": "impr_279.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a05777eb-90f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1617066590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066590, "uuid": "30106382-1599-42b1-a375-3825ff50aeb6", "comment": "Malware payload (Mirai)", "value": "3315ef681d3df003c37b1a00e3e3f536", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066590, "uuid": "fc0e945c-f6a9-48f3-ab16-463128110808", "comment": "Malware payload (Mirai)", "value": "0c45b6faed996600eb05585c532fe7e9d34dc85526afffc08b2fe0fda204f0e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066590, "uuid": "6f2fc993-c4d7-4a68-8197-69d76b20c90b", "comment": "Malware payload (Mirai)", "value": "c968792da751e700f699f11e9d2482f62bf0d11d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066590, "uuid": "862c73e2-f6c4-4fb2-8477-039258dcad4d", "comment": "Malware payload (Mirai)", "value": "660418c2bc5c403e0e58e11b1421c093d12c88ec3cda7fac3d8b91fa1e076a43d4477e1d31613516bc381f9f3bfdf0df", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066590, "uuid": "c7caa87b-3202-4c0f-93f7-5c87c2c9be3f", "value": "84F261592E229FEDF76DC63147B34B30679833E126E0C684E26DD5040FA034E695FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066590, "uuid": "13c2a2c8-b17a-4eba-be13-af7d52d8b553", "value": "384:mvehrRQU9VrsiB3ynn8FvTMEPNG4gaLZ0aZdct2FKjUxt8kdev8tXAm94ClJs4uA:mvepeiB3yQ7QNSZ5hQAn8kymaCl6bTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617066590, "uuid": "82e69f75-3762-4a57-aced-e978254123d7", "value": 36384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617066590, "uuid": "75bd58d7-3a8d-4866-924e-6a586ba92491", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066590, "uuid": "9daf048e-5daf-48d3-8e2a-1078aa27bc7f", "value": "SecuriteInfo.com.Linux.DDoS.827.10876.18228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc7511f-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617106663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106663, "uuid": "fad581a9-c9f9-4448-ab92-8653cdb7387a", "comment": "Malware payload", "value": "dd3f606ff6b05d0baa0753e1f92b9c69", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106663, "uuid": "9d20610b-c1b9-4337-808f-81a9799fd023", "comment": "Malware payload", "value": "0c8ec2c96e9e83fca9729fc12c311284206c6a50c8368cf2b03e67e05745a4d2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106663, "uuid": "42b58b18-1798-43d2-9b51-0fa944227541", "comment": "Malware payload", "value": "a49cfc730465eb9cd9ac432d081d6b080d26e190", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106663, "uuid": "5f632911-b111-4a64-bc02-0edef640498c", "comment": "Malware payload", "value": "a544a38c4ca10fae64ba453e481561bab83ab83273c87542a6a82ed7ca91b6de78d05a6640c095d0f87f4d32b5bfa0da", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106663, "uuid": "689f96cb-3b15-4f93-817d-e863fc86a8fb", "value": "9662D05F584F635A69B96D2857C0CBFA20D639C4734CB5024A7AC0CF548EBF3E251591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106663, "uuid": "4cad74ef-afb4-4195-b13f-6604e6c8e41c", "value": "384:VXSMElhc1I3FbghAFoeYm3UYo6ePXwD+ppt8Zlp8+YH7C55FED:VXfEla+3Fb8zXn6pD+pptK3ws3ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106663, "uuid": "25fca362-9f27-41e0-998d-75e708f518e1", "value": 15091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106663, "uuid": "733d0cc2-feb0-4fd6-8ed3-229ec173036c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106663, "uuid": "d2e42d5c-a076-449e-a359-441c5a5085ff", "value": "PO4648 PO354648.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eab9843a-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108805, "uuid": "b9b5afc6-4d9e-4826-a1be-ee3470b4dc7f", "comment": "Malware payload", "value": "bfb2a964adc8951aa9bfcbd7fa1f9dcd", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108805, "uuid": "97402173-9b23-4a70-bba5-20060323e37a", "comment": "Malware payload", "value": "0ca9bb2478c6041a915cc30fce082ade12f1d3e10239df634e711d1c57ffd0ca", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108805, "uuid": "bb2bfb72-f4f0-40fa-a159-e2d1a489e6ca", "comment": "Malware payload", "value": "f99fa48a1898da923593219964262ce817f41e86", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108805, "uuid": "7f354171-dd9f-48b5-99ee-4477e1069b9c", "comment": "Malware payload", "value": "596a819c59eb58c195af60d6c58064f0dd2ea2fcb9cd137bdee42623c2c8adf349a62bf0c5e264860e3a344726ca977f", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108805, "uuid": "c6de893a-b09f-4c0e-9678-50ef16df9acd", "value": "9E93122388E5DC24F3D0D27B414B7FD36C5FAAA1093E4F9BD170AA429DA1D766CA09C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108805, "uuid": "6e6f6c68-40e1-41f2-b3b7-dcbb9a3791f8", "value": "1536:bfufH04f/qKNLI7udiJCAhg3cXINyR2CuGRGurV00aJtA2Vj/Sz8GBl+4e:Tuf9lxWueCD3mYXCbrVVaJtA2VjjWY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108805, "uuid": "1e0c8b86-84c6-44f4-a82c-29f6669cd718", "value": 93376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108805, "uuid": "29c1a368-01fc-48d6-9f0e-c28e010b9022", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108805, "uuid": "ce5e4800-95d7-47d0-b6e7-0a92a06c6050", "value": "lista_2524.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "667f3c9c-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617105577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105577, "uuid": "81e30d88-b904-4c5d-8ba5-715faf4b8961", "comment": "Malware payload (RemcosRAT)", "value": "2669b367e19d303277d90e1df00141d6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105577, "uuid": "e2e82fd6-ac52-4fc0-b25b-80261bd0dffa", "comment": "Malware payload (RemcosRAT)", "value": "0ceab68641ca19a5f55d30cfc6f0e714c62cbec56683dd723704b890e9863983", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105577, "uuid": "23d0d486-3ada-4c8c-b8bd-1e21c2477a4c", "comment": "Malware payload (RemcosRAT)", "value": "e1acf19515cc4ce7cd4946226510a4b63a20571c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105577, "uuid": "3927ea84-b48a-4b96-80eb-583cb0689252", "comment": "Malware payload (RemcosRAT)", "value": "28cee0b266def0b94697e4698e1126962f534ca9114a50e11b8af480a8c0724161518dd5bd211a42aa85edcbf182b372", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105577, "uuid": "1a900a0c-6fcd-4301-91f3-8aa6bf73cf13", "value": "1175E0F946AF6581EA4D1D692D087B812F3BF336A9D14440F3BFDB3283778488661A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105577, "uuid": "60943d9d-2778-4274-8a23-20c103e53093", "value": "24576:N05UpMiopppppppppppppppppppppppp+5I:4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105577, "uuid": "1f028c70-0dec-4353-ba5f-7f05a8467ba4", "value": 1630038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105577, "uuid": "17a27d70-521f-490a-8bfe-40aaf01039d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105577, "uuid": "f3d8eefc-46ab-4c2b-9540-91724969e225", "value": "SWIFTCOPY_110255293303484_SANTANDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a546a9b-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120132, "uuid": "4f294661-7a5e-4d2e-9970-c969b21b1dbd", "comment": "Malware payload (Dridex)", "value": "7de7776a2b3ec5d4a6bfb0bde99de5d7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120132, "uuid": "e6a0177a-840d-4e63-b39d-942cb5d0ec45", "comment": "Malware payload (Dridex)", "value": "0cf0f9786c32bd4eb8ee082770d7f80e5082526d74f5a75c6813eeb00c131e49", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120132, "uuid": "efb4467e-40a5-4229-8f76-5c6cef077ea7", "comment": "Malware payload (Dridex)", "value": "b7199327618d1df24bbf7e08eede5a03e47195ad", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120132, "uuid": "9122de94-10fe-4888-82f4-556f98422e09", "comment": "Malware payload (Dridex)", "value": "8fe34505f99b3fb840bb6f7d40b946e28789d736eb5640b8c4a475681af2651281e418d4ebc5644b5f7270c72e529d30", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120132, "uuid": "231cefa5-fa58-448e-9764-d2cde2b12fd9", "value": "D814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120132, "uuid": "dc930976-7837-480c-8fb3-4e10e5249672", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120132, "uuid": "82a54db0-da8f-42c8-bcea-17709aa823d4", "value": "3072:83PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:4Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120132, "uuid": "cb1388af-78aa-4698-b17b-1409b8867fa8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120132, "uuid": "dede48cd-e66b-4e0a-9519-2d3e97908f32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120132, "uuid": "99792551-a16d-4bd1-93b4-fc2328203cd3", "value": "0cf0f9786c32bd4eb8ee082770d7f80e5082526d74f5a75c6813eeb00c131e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1d71be-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137265, "uuid": "ad3b7739-4cdd-47b8-adfe-06b7f933a953", "comment": "Malware payload", "value": "b8cb5afcdce47806abacd738646825d1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137265, "uuid": "2b4f8c2e-639c-4e59-a568-08faee78af4b", "comment": "Malware payload", "value": "0cf83e6c8d9cc489d2872d03ed05722f07d6c2e2d525f4a1e6facc4ea839ee45", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137265, "uuid": "80a058c6-91a1-478f-969b-cb9a9da9717d", "comment": "Malware payload", "value": "8a27dda184e8d6b0ea351860ba70222df3f66e94", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137265, "uuid": "31d28f3e-9c70-48c3-b48e-2a74941b39a4", "comment": "Malware payload", "value": "e0f3e92cd0312f0265ff5919fe1fe41726b72fce2064633b98c55ede6fac9dd6e84670342005525ad7d1e8c5f8129a81", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137265, "uuid": "7722c675-4190-4ace-8bfa-157c9aaaac7a", "value": "0014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137265, "uuid": "0802d7ab-ba2a-471f-8bed-22936d38a4d0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137265, "uuid": "8830f50b-896a-40f3-ac68-579b2a574946", "value": "3072:T3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:TJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137265, "uuid": "053112a0-16c3-4ffe-834e-9e7511eaf229", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137265, "uuid": "94bfdbf7-5c37-4018-81b9-92c33897b37f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137265, "uuid": "1d6900e0-ba78-4dda-9ce1-052212354fd0", "value": "0cf83e6c8d9cc489d2872d03ed05722f07d6c2e2d525f4a1e6facc4ea839ee45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1424f5d-9148-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617102696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102696, "uuid": "0f1be045-05ea-49c7-8083-7e6f6dd6c4ce", "comment": "Malware payload (Loki)", "value": "8b8fb36315a59830551a530e15027cf9", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102696, "uuid": "45d8b037-1f63-4c6b-a6e2-8da82707873c", "comment": "Malware payload (Loki)", "value": "0d14dc560254bac92bf251a38f4c35befa50e220a2527e65bfff73c9e26d3db8", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102696, "uuid": "60f3b58b-ea12-4415-8a04-12f2c4afcdf9", "comment": "Malware payload (Loki)", "value": "a5d5d916a1d00147c941adfa667c9fb7ea67aec8", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102696, "uuid": "99323e31-c188-4cbc-876f-d47642844add", "comment": "Malware payload (Loki)", "value": "1761cf9ecce2266417f416c9ce066416dba87a45009de492db2c62e2ebb9179084cdca7ac84c29fac51f181a5e0ac981", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102696, "uuid": "446b6a62-308d-45ac-aa9f-cc92eb75e504", "value": "F3E312D686AF4DBC89A33F21EE6C566F3BF6049131456C1178AF2812077679D4BB2C06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102696, "uuid": "bca4d211-e4c9-48f2-a04a-8a7bdb868487", "value": "3072:QnkfwoiDkQ7zIU7GaiUuQmkbIcJ2LPyU1Fy5ykWgx609EhDqMo9Ooq87Nk:ak4ookwGH0mjWU1w0kWh2kP87Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102696, "uuid": "c5635054-0007-4416-a2a5-09e1d2899838", "value": 154459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102696, "uuid": "aec63516-3f8c-4e60-ae71-635e623e0266", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102696, "uuid": "4ef2dc88-04ce-4f8e-9504-dbcc9e8a7506", "value": "VSL_MT LOYALTY_pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e35bd03-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142365, "uuid": "c809bedb-4543-42d0-9912-43c980dce2e9", "comment": "Malware payload", "value": "248471ab0c1d609f3eb3dad424d9401c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142365, "uuid": "3dc88ac1-76bb-48df-8292-cb85059d065e", "comment": "Malware payload", "value": "0d168be4c63da94b908afd37d3aaba20b3ecfda6b661988bf070ae4291fe9644", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142365, "uuid": "ffe5fdbc-fbd7-42f3-9850-0611c06a36e4", "comment": "Malware payload", "value": "5dd230cfb5f6b71d49b7a5b6ccabd500e4f50ea3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142365, "uuid": "edcf32e2-6f61-4aea-92a4-78a084342d6d", "comment": "Malware payload", "value": "cce41f828b361cebb6c7ee4fe90424de9e89f927e958e8e7af765cc59087b8e62a07e99104769996a757ddd2f74dfc81", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142365, "uuid": "e05393b7-8464-4922-a0b3-f4f5a067f2a1", "value": "F414BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142365, "uuid": "38033b89-d24a-425d-bb94-b8ce787490d4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142365, "uuid": "fd42070b-d0b4-4779-9aa6-77a20fa38da6", "value": "3072:v3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:HJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142365, "uuid": "f882ad17-6aea-4bf3-a3da-bf17997e40ce", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142365, "uuid": "c8aa8e65-4a8f-4de4-a138-cabaf8446176", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142365, "uuid": "c2891ef6-c389-44f4-9694-ad4cbcf9cab8", "value": "0d168be4c63da94b908afd37d3aaba20b3ecfda6b661988bf070ae4291fe9644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7d9983-91a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140433, "uuid": "e0562058-bacf-4c85-bc13-241a678cd6a2", "comment": "Malware payload", "value": "8f7ef95daad212e8fdb61ffae7736b32", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140433, "uuid": "6d3080bd-0c1a-498f-a8c8-9d84a9140f78", "comment": "Malware payload", "value": "0d1ad4999e74dc7304bbf94595f995b23c16d4782479d76bdb12f3727600a365", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140433, "uuid": "1a17cd42-68f6-4ae7-8d7f-a9807f07a130", "comment": "Malware payload", "value": "f9d7d5867a7b5f144e916edd15e4a0f2aee73890", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140433, "uuid": "2dafc8c9-7610-4f06-8f64-c52aba01edef", "comment": "Malware payload", "value": "f368671a3dc31bfd5924d8e6c5336f11e45d2158e55bd339a0de62ebbec9e24380fa8ba32d0a0be61853c5dc801d6e11", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140433, "uuid": "a082ef77-3a07-4323-9b90-386cdae4eec3", "value": "EB14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140433, "uuid": "6735fbed-ce23-4e40-8c20-872bb6a7ca5d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140433, "uuid": "d78a7708-7940-48ca-a2a2-cbf16fa806ca", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140433, "uuid": "97914d98-573d-4abd-818d-a9322e92eec6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140433, "uuid": "a2074c39-152c-4eec-9c05-040df191990b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140433, "uuid": "4d03c72a-26a7-481b-8b52-9697b34f7c10", "value": "0d1ad4999e74dc7304bbf94595f995b23c16d4782479d76bdb12f3727600a365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1261e7e-91b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617147820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147820, "uuid": "6dcebb87-f36c-41f7-84ba-876cfa3f3e08", "comment": "Malware payload", "value": "c28f1fdb7880c7f16422d547d9ee3913", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147820, "uuid": "60889be5-aa05-49f1-b3f7-0f9d80fed69c", "comment": "Malware payload", "value": "0d5b08c2ea0804a1195e7cdaa1931af9b74f4a1f78557d55dd2b89760eec9769", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147820, "uuid": "fb3c6727-af82-47e1-aa68-94b361a96a7c", "comment": "Malware payload", "value": "6532a2604c9c378a7c00bf02ac810dd99f242648", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147820, "uuid": "de91209b-3c15-4d3f-98e1-237710176d74", "comment": "Malware payload", "value": "da6b79e36f90c0942145f949029863c44be0b06cb3fa9dc02ce77a5c260509f3f2faec457c20ccaaf31ffa592c2ac298", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147820, "uuid": "56dbfa84-f9b8-414f-b3c9-1e2ff9f3747b", "value": "4514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147820, "uuid": "a9d7fbf0-8313-425b-ba08-5fedf57558a1", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147820, "uuid": "d6ee1501-a66e-4fa5-8f59-a84dfaeda213", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617147820, "uuid": "ed8deca7-9594-4ca0-a5d3-877f3d2bf3c1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617147820, "uuid": "58bcbb24-f8b2-4845-a245-f5d2458d6a04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147820, "uuid": "33be8eb3-a7bc-4c07-b77f-101b77626b28", "value": "0d5b08c2ea0804a1195e7cdaa1931af9b74f4a1f78557d55dd2b89760eec9769", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56ff2d3-916f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119480, "uuid": "b294f4f4-ac21-4f9d-86e4-442c12969431", "comment": "Malware payload (IcedID)", "value": "84a827f196a696e301cb3982e52582a6", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119480, "uuid": "a64f02ec-e6e4-4586-9f06-4143acc80632", "comment": "Malware payload (IcedID)", "value": "0d63b09ac8d75a82e197b55537c1bc947781694a1cff210a5001ef79f204fe8d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119480, "uuid": "0fd6c1b7-1819-4a13-9576-867baf386cc7", "comment": "Malware payload (IcedID)", "value": "44168d8a1c5e2cfd7b4a45a1d51d2843578f7904", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119480, "uuid": "6c9087dc-dc08-41ad-a637-cabfd051d8a8", "comment": "Malware payload (IcedID)", "value": "cad5f17e4a48891aaf8c68932689e7b45d9b8731717ff02065984bc80a05e19e4585a09dd694874fcb3395442d7f0e65", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119480, "uuid": "a39b44f8-6757-4fb1-aaf2-67d4edd47e36", "value": "16B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119480, "uuid": "401dc89b-e796-48d6-ae98-d88f9dd25485", "value": "3072:o2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ozxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119480, "uuid": "0c390d80-656e-4f50-a747-23f5cc4ca656", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119480, "uuid": "7c7cabe7-7f75-4b76-bbb6-4ab037803f02", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119480, "uuid": "41bec146-68e9-4dbc-8033-a960f485c42c", "value": "document-52023271.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00b0b21-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127175, "uuid": "b8765fd7-2c58-480f-86ba-5c32674fb01c", "comment": "Malware payload (IcedID)", "value": "b0db227b30905af36a73b17b4719dd56", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127175, "uuid": "09eb6565-1f12-4720-a07e-7e0b5e9d631d", "comment": "Malware payload (IcedID)", "value": "0d690f3ed744558dc52a623f9e8609744355ff83f5b0f773e337de40d733dea6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127175, "uuid": "ef1c0165-b476-483b-968a-254d00fda4a0", "comment": "Malware payload (IcedID)", "value": "b0af7b90e2714effc50566135dcc31ac0c7ec085", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127175, "uuid": "5f3fd6ad-2e3c-4e23-91bf-ecfeecd39e67", "comment": "Malware payload (IcedID)", "value": "d82a7afcf1d3f89491f50f83ee991a1f328d52bb76c697e206b8613f45ee47a5c05afb38f2aa6f288a751826c7583602", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127175, "uuid": "38de9398-a180-4387-99f0-70af3d5584bc", "value": "8BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127175, "uuid": "6f3cdaf5-25d5-4f5f-bbdd-a592c552fdef", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127175, "uuid": "84ab269c-f3a0-424c-8744-2a699bff5194", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127175, "uuid": "be392ed4-7f3d-4f64-beb7-94e043c311f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127175, "uuid": "a1e90305-ef15-412a-9ee2-c777105b5cb8", "value": "document-538282625.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79943174-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Stop)", "timestamp": 1617082845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082845, "uuid": "c99d8906-1d95-4cc0-b62b-a6fc859cc934", "comment": "Malware payload (Stop)", "value": "fda422a54b108ec592b499e0dc59e6c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082845, "uuid": "f9785e8b-e8f8-4578-a24f-1b4c148429fe", "comment": "Malware payload (Stop)", "value": "0e55e17532909ad5ad34eb4e35d791b27c6951dd15a8baba34c29ae572c884d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082845, "uuid": "e93b7fce-9650-478d-b46f-0c9b871884ab", "comment": "Malware payload (Stop)", "value": "8ee655935d7620a6d2f18f26d0532f9dfa8b56e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082845, "uuid": "e28a8151-8f00-4d03-8dfc-628bd8367b6f", "comment": "Malware payload (Stop)", "value": "afdbef81580c80b31b3410db36df03eba7d73446bc4b694448ee92053fe1219380d77964653e57555da9beb4063ac78f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082845, "uuid": "79b3514c-d994-4c57-928e-8f6f1b702571", "value": "BBE4121171DAC077E99619358861C7314E6BBDBA4B349BCB2FD127B95A362C18F32343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082845, "uuid": "f2f58a0a-8858-4fe1-98c1-ac2f107b94a3", "value": "e1187e29c5f4ddd697b33e3d5d40f68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082845, "uuid": "f323d896-44e8-4602-b561-cf52cfbaeb9f", "value": "12288:LZ79tMnqP/+9zSj68hq3G19KGlbxAVpoZIo98tq1aWJLdzrI9zjZttTa:LVsqP/+9zSG0q2PzxAVpA9rdzEXf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082845, "uuid": "c6986690-e5d9-479c-96f0-374dffccc53d", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082845, "uuid": "2a3326f0-8dab-4d0e-9fa5-fff1d5116a9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082845, "uuid": "9a270af0-d881-4638-b5ea-176c145472fd", "value": "fda422a54b108ec592b499e0dc59e6c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc23e7-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114387, "uuid": "00b7873a-ac0a-4589-9b29-b39ee6019d51", "comment": "Malware payload (Dridex)", "value": "4ca70b0b3377d341f55d661fd3c0683c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114387, "uuid": "b6cfa411-2a6d-41d0-a8a3-55dd25d7387a", "comment": "Malware payload (Dridex)", "value": "0e6bed85b3d8ce50df10c8a4ef2ac42d6e857a7513e7944c94655e72fe84f418", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114387, "uuid": "041f6c8f-64f0-4f49-bfbf-c878e4cc424b", "comment": "Malware payload (Dridex)", "value": "407fd5c49ca0fd9a06949fd6723d4f6d09baa108", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114387, "uuid": "ea1fb628-fd48-42e0-b808-a97ee22f4a78", "comment": "Malware payload (Dridex)", "value": "a120883ed4f70334aad76b88103c91d6fdfb085ea4deb9adad5a1c5dad13549ab21cf75cdaf48977eda3d7ff24793b50", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114387, "uuid": "432816df-13bc-4967-b4d7-f772f85181cd", "value": "F914BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114387, "uuid": "08715b7a-76b1-4c80-b074-0dd3f11312e6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114387, "uuid": "94276b0c-072a-46d2-8a8c-54a26b63fc31", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114387, "uuid": "2b38e2c9-107f-453c-9e79-7ed088ec083c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114387, "uuid": "72ca5d11-0c83-4f57-98f1-e6ad1d6dba2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114387, "uuid": "a53f645d-c5ca-4d8b-ab9c-d7cf46bc455e", "value": "0e6bed85b3d8ce50df10c8a4ef2ac42d6e857a7513e7944c94655e72fe84f418", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab21176-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117932, "uuid": "e5bd03ec-18fd-4eda-9285-986374970c5b", "comment": "Malware payload (IcedID)", "value": "793e07147a14afc6e785217a3037a1ee", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117932, "uuid": "b149d016-6240-4cfa-a057-6614065fe150", "comment": "Malware payload (IcedID)", "value": "0ecde2f0b5bf6b327bfad2ba496c68a102bb8a0fbf7693f95939a85ae57cf580", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117932, "uuid": "d45c279a-9c71-4fdd-aea8-2735f88221e2", "comment": "Malware payload (IcedID)", "value": "7b84bbfdd833eb05913f8532435ebbd5ff6d4233", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117932, "uuid": "6b22dbb5-557f-4044-bcde-d7aaae7d50e7", "comment": "Malware payload (IcedID)", "value": "346c68752b8ed3fb1debaffb127d8fc6d31e4c87fc4aa48239a0504ba91c438b68caa12fd129c4e8c550414e036628c8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117932, "uuid": "96ba6536-856b-471f-bf28-f4a96f3bdc4c", "value": "D8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117932, "uuid": "858e541b-9006-45a9-92d5-8e93231ac620", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117932, "uuid": "2603a068-3a27-4ffb-b073-1361b06ecf83", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117932, "uuid": "ac6b5084-0535-42c2-88f7-e4b70497aa65", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117932, "uuid": "df34fd45-52ef-478a-bbe3-a5831ab3be6d", "value": "document-1852856632.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3747df04-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126543, "uuid": "d11490b5-2dcf-486d-b9e9-a4dedff2d526", "comment": "Malware payload (IcedID)", "value": "7589662320d1ff7f0022ea67f0106b00", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126543, "uuid": "61fdad6c-5ca9-4d8e-9112-09093e36ff77", "comment": "Malware payload (IcedID)", "value": "0ee6fc05ecc43fac14b4882f198758a4b97616e4474ebbcbdf7cb954daa6beee", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126543, "uuid": "9bbde4aa-ccfa-4fc5-b3ac-96d3213692d5", "comment": "Malware payload (IcedID)", "value": "ba5610b8824dce2a1f07a6cc0e2e4938072d0b5c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126543, "uuid": "23d31908-d053-4a27-a5d4-a3b4dc0d79c9", "comment": "Malware payload (IcedID)", "value": "240fc3c0d27c48649f447966f2921f5d98aa8c7fd9316e16421f8dc7613fe84143dcdb5272fe064e8a9cbeb8ed0948b7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126543, "uuid": "26136108-4b5b-4d88-b9e3-7ed71b30985c", "value": "F7B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126543, "uuid": "88db2ea6-f7d7-4d15-86cd-125c44309127", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126543, "uuid": "192df971-9f5a-4350-b2eb-cb7d7cd13b81", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126543, "uuid": "2c8ed65d-24b5-4a32-a258-0a6e70bca004", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126543, "uuid": "93f80a11-b015-4f82-9379-6f4c74a6d450", "value": "document-1563354778.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592fe7e8-9187-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129606, "uuid": "9d6c6a60-d16e-4291-b182-764a5359ad11", "comment": "Malware payload", "value": "ae34c0cecf647ec416c38d418adfa6ae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129606, "uuid": "34a64494-b326-4e61-b3ed-e4c65c58a952", "comment": "Malware payload", "value": "0ef9838e995f2a2f74cf56cfa042663dce588d3288f3d2d686c2e4878f196abf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129606, "uuid": "5acfe783-c1e4-422e-8e39-6c82f4ad08ec", "comment": "Malware payload", "value": "4c6b70fef3b48a13f502dc21d984fdd57783c247", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129606, "uuid": "d5d947da-9f27-4f95-b69f-74a5e8856510", "comment": "Malware payload", "value": "c20ff2ca95c0cb342609fe1456ff8a76ab1cb27dabc9d86410f0dccf2c9696b47db522a8d3300e15612f0a20b9a5989c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129606, "uuid": "8441f0ec-462c-499b-9b5e-0d1527b48e4c", "value": "3714BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129606, "uuid": "67cbf23f-992c-44e7-bbb3-fa85ec63f3a9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129606, "uuid": "72c53333-34e6-4c5d-96a9-8d2f036ed7d7", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129606, "uuid": "6b176deb-3886-47bc-8073-4e32b56ab68a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129606, "uuid": "aa76ad9b-a3a9-4367-a6ba-ef4c63755c74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129606, "uuid": "202d52a2-d79d-4da3-b8a0-fb98bfde0e09", "value": "0ef9838e995f2a2f74cf56cfa042663dce588d3288f3d2d686c2e4878f196abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee12015-9106-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617074318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074318, "uuid": "c9b0c45a-3790-4ff2-99b9-2403971fc181", "comment": "Malware payload (Dridex)", "value": "b1cacf7311d33fc66d20d01a68675bca", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074318, "uuid": "d85fbdd7-bff8-49ff-b271-1ad4ef0d719d", "comment": "Malware payload (Dridex)", "value": "0f34e1cb392c58a5885e73b1d1411efa7140ce6eb20ea39bbf4888d9e531d122", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074318, "uuid": "6e10155d-9cad-4599-bf9f-f211f350a7bb", "comment": "Malware payload (Dridex)", "value": "326b4e02060ea763ba216874eeeedc96ab809fd0", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074318, "uuid": "efe5ae2e-964b-4b9f-b9a7-461960b533dd", "comment": "Malware payload (Dridex)", "value": "a207bec3733bdb4aa4f09da22e25dfe805a72805d8811b73b7e4fb0efd4b851181735f999b63caeabed877f4d0ed769b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074318, "uuid": "5b916331-8e3d-4ceb-8d4e-5e3d0c1b1514", "value": "EEC4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074318, "uuid": "ec6b3192-038c-4695-88fa-0fa3859553a0", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074318, "uuid": "9517e893-a790-4031-b8a0-0406c99da54f", "value": "6144:KGiMOQpsduhD3AZHC/uNbExd+44uwj1b0717WLmw6Xg6DqaIDnnlvgh35la:TVhDQZHC/uNY+/jRm8LYQOQlYDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074318, "uuid": "70f1a18c-2c6e-4624-93f5-30a11f5910c0", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074318, "uuid": "9d71bdd6-97cf-4650-a984-8988f12af7a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074318, "uuid": "dee85d4b-9265-484e-8c87-01b6b1553326", "value": "0f34e1cb392c58a5885e73b1d1411efa7140ce6eb20ea39bbf4888d9e531d122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d987b3-914a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617103287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103287, "uuid": "80899ffc-b4e1-4f82-848f-d5aa21ce1201", "comment": "Malware payload (NanoCore)", "value": "4218b517444e8b2fdee5434e70f9886c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103287, "uuid": "e0d8e47f-5688-47f4-8e01-8f69866f1e93", "comment": "Malware payload (NanoCore)", "value": "0f7e350baddcaf777d8f8301bc9d0d4444776208ce3dbd3b4aaeaff5b8d84371", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103287, "uuid": "61911074-35af-4994-b656-219bd821f12f", "comment": "Malware payload (NanoCore)", "value": "939282408254fe3fc9af9da471cfbd04c9ee3f31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103287, "uuid": "eed65e66-c544-4919-9749-56a1b006aad2", "comment": "Malware payload (NanoCore)", "value": "7146dc529c7ff0e108433c259205eb1b062607951ba92f05c48b95fc3ad72ab7b620e52cf1989afae30c1095dbfe3cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103287, "uuid": "99a5ae0d-5a78-4020-8f15-be68799523c1", "value": "B1252F54205D4C9AFFF49736B56663612B86B7311E61EF2AA8B312301A63735FB4BC30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103287, "uuid": "d45b3362-1a7f-45b1-a09c-6aced4b8aa2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103287, "uuid": "98192c1b-42b3-4313-a925-6b4805440c4e", "value": "12288:TuVUzaBlvxJzwnqAW9KqiniA0M7+U690rQ:xOBDcqYuMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617103287, "uuid": "26cb6730-620f-433a-b749-4e1614d5fafa", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617103287, "uuid": "a1c8033b-e1bb-41c0-89c9-20630cf14708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103287, "uuid": "63e50d03-b0e8-4614-92e0-14742f824b21", "value": "SOA6058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e754daef-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115242, "uuid": "4367ffd8-7e76-47ac-ab0d-1f145da18b57", "comment": "Malware payload (Dridex)", "value": "46d19e454f4a5ce3dbeb65cd9242d1a7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115242, "uuid": "03658818-1dc4-4134-adc6-27bd7987e836", "comment": "Malware payload (Dridex)", "value": "0f998eaee8defd6b869ed767f92d6009c20763e90e2fd693784fc62b96732a12", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115242, "uuid": "a6f745b8-dc32-4667-b6e8-7464ea5f21dd", "comment": "Malware payload (Dridex)", "value": "bfc95c4cddaa3d2026eb5f53778390eba3f1f4ce", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115242, "uuid": "42744f35-1604-49f9-8b6e-2f881471d824", "comment": "Malware payload (Dridex)", "value": "e1fd95415ef49bf043dd6091ed0204bdeef1f894ea98ceea96c33ff37c4ca3b025658c9ff1eaaa40c50ab42908bc287c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115242, "uuid": "34e589c3-5e41-4a62-8cbf-f20eb5120e22", "value": "1014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115242, "uuid": "d7424f08-d664-4f6c-94e0-9e7a1f5ce90e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115242, "uuid": "57f01a57-73eb-4309-b365-433252fdab7e", "value": "3072:j3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:DJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115242, "uuid": "bc45f7fb-e8e6-42bc-a488-a994f79708a6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115242, "uuid": "1beaeca0-918f-40e9-bc3c-ea885299869f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115242, "uuid": "1d21a15e-1fbe-461e-96e6-74e371a9df4c", "value": "0f998eaee8defd6b869ed767f92d6009c20763e90e2fd693784fc62b96732a12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecb7766-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114395, "uuid": "fe547c6f-6675-4a9d-8e63-7e6a1813dc45", "comment": "Malware payload (Dridex)", "value": "47e7e197ec76957476f491f99d10faa9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114395, "uuid": "20d3d721-3f3b-4166-9dff-1eabcf8e1f8b", "comment": "Malware payload (Dridex)", "value": "0fc196bd59ae4107f96cc7fa987307b10edd1b81fb94ea87572900cb8100d9eb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114395, "uuid": "21d4e974-fcc5-40eb-a0f5-253c30af066b", "comment": "Malware payload (Dridex)", "value": "c713d421f076fc5bfe31509f69851eb66706d7b7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114395, "uuid": "131028f0-4422-4c7a-8874-5aec94b17ae6", "comment": "Malware payload (Dridex)", "value": "a6423585c39e91d955dd494f032ad85ce005ce0d0b5c05c597b82b8ad176ec9286b17d74e6112df2fbd65fb0cf5c750b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114395, "uuid": "9d847ad7-1ff4-4cb8-824d-b7d968207711", "value": "D214BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114395, "uuid": "3256757d-d56e-43cb-860e-78bbc5419540", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114395, "uuid": "cd741414-275b-43ec-a2b6-b873abc31c81", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114395, "uuid": "41aaeae1-46b0-49c5-b6b6-88f87a2abed6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114395, "uuid": "d8c957d1-ac70-4dac-98ba-af235867c433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114395, "uuid": "264905e0-6232-498b-a160-b1e394df0633", "value": "0fc196bd59ae4107f96cc7fa987307b10edd1b81fb94ea87572900cb8100d9eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e531a7e4-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115238, "uuid": "267a0d03-a6bc-4e80-acd5-54de413a2d76", "comment": "Malware payload (Dridex)", "value": "c859a1b1b185ff1e5db756d05af55185", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115238, "uuid": "b7e76c02-12b6-4450-8f6b-376ca5963567", "comment": "Malware payload (Dridex)", "value": "102fe63b0f487d27e0112d55031d8ad5ea5ddf9847db5672da270731572b3700", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115238, "uuid": "ded88b39-fcc1-43d8-9a1c-10fffb4f6df0", "comment": "Malware payload (Dridex)", "value": "4de53a95ddfcafca7206f1b9b543606b66ffe103", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115238, "uuid": "0e300e3e-e292-4fe5-bba4-6a99ab563240", "comment": "Malware payload (Dridex)", "value": "18f2032e29d097556635db73341dff5472eff61133c2752c770bce94949bd1ba72b328954cf6ea8c4f178227457b02ce", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115238, "uuid": "a4bb3ebd-177a-4b29-a6b8-caa59b1e32c6", "value": "1314BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115238, "uuid": "82e1a59b-7f28-4d0e-93d0-1381d919ad9c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115238, "uuid": "8803a37c-ac8c-4577-a5ef-a65008d60b92", "value": "3072:q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:OJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115238, "uuid": "93404f38-2dd6-4e5e-8662-95d1564c5e7f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115238, "uuid": "e92e54cc-2871-4870-a166-a9d76f5b48db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115238, "uuid": "1b2e26f0-36c6-4d56-9034-5b7b6aa7d0ee", "value": "102fe63b0f487d27e0112d55031d8ad5ea5ddf9847db5672da270731572b3700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797ac95e-9194-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135244, "uuid": "c6734682-926e-4981-8d63-6592b7b80a7a", "comment": "Malware payload", "value": "0f2ce64a0321a30caa042f4ccdc18bf2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135244, "uuid": "8c6dfecc-5e9d-4a81-9c11-b05eaabfcf0f", "comment": "Malware payload", "value": "1043d94b3fc569b37d81e630d61c73dafd86613ca47c6a2b8f188cd591bb067f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135244, "uuid": "c8f5a743-8f05-490f-abdd-e22bdceb26c0", "comment": "Malware payload", "value": "299ce1bb961c7ddab17c2f2e540bbe7603fedbbb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135244, "uuid": "d67ca662-7948-484b-8136-046c584aed66", "comment": "Malware payload", "value": "451d78bcbcb75ca84fcbd533df57a157b2b8d9e4bcb3cb27983a62baba2c69f75d4b04955cd314a3c251252f49ef96e5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135244, "uuid": "e49f780c-34f8-4705-9d12-bdfdcbc3b284", "value": "8D14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135244, "uuid": "90dd1db4-2eaf-4917-adf6-1c8f13dadb0d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135244, "uuid": "8360e410-a4d6-413a-93a5-9ef18b6aa7c1", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135244, "uuid": "809bcaef-9401-41f8-b1c5-f0bbcebe1dfb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135244, "uuid": "4023eaf6-5f70-4a5b-a478-9af20a61305f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135244, "uuid": "eee4a76d-809f-4fe9-881c-da1246f0b358", "value": "1043d94b3fc569b37d81e630d61c73dafd86613ca47c6a2b8f188cd591bb067f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e59a258-917c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617124998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124998, "uuid": "00134994-28ff-4352-baf7-14f1db1ea21e", "comment": "Malware payload (IcedID)", "value": "46ff7869606b1ec80a03e9ed92b1c49f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124998, "uuid": "799c057e-9fc9-4af0-81e1-8edd5c1d5d0a", "comment": "Malware payload (IcedID)", "value": "107a5a5e1df01afbe5072aecc0a86fb73ad0dc810c6ad578b3d6406b54596847", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124998, "uuid": "c9436b46-4c10-4e51-a837-ceb476e594b0", "comment": "Malware payload (IcedID)", "value": "dc101a6bdf2bddd67258d01ff4578f79a4b9048b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124998, "uuid": "2648ef27-c289-4c64-8076-8a0e89b5eeb6", "comment": "Malware payload (IcedID)", "value": "18b2ef4ba32aeb622cba6c34ea309dda95d4eb0aa049115f839ce267181d4c2932cae848a7dd7b82fbb6a0ed8b32ec72", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124998, "uuid": "4aa1cea8-a5d0-4913-88e2-9eaecd952a45", "value": "D1B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124998, "uuid": "18790285-0d74-49e1-b022-fbb898e4aadd", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124998, "uuid": "548def14-0df9-4ae7-97e7-acc63d9202f4", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124998, "uuid": "4b4e7505-56ba-4377-a4a7-b039b226585f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124998, "uuid": "e3514fc4-fa57-4086-be21-43575c6d8a03", "value": "document-586756930.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b1fd62-9186-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129169, "uuid": "ee4ce3ec-15d6-432d-bfa2-6b8f2188ca75", "comment": "Malware payload", "value": "1d4cae4221dd16459caca493ffca81ac", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129169, "uuid": "48980cd9-cb60-4af2-9894-0c3ad388bb8a", "comment": "Malware payload", "value": "108067c498b6194d78e5c3dfeaf52cfbbead6a2456b0a954c18695c9dcfa7a55", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129169, "uuid": "9e70551e-e234-40d0-99ae-25bbbed07465", "comment": "Malware payload", "value": "c19093dc5afc12ce07de0b19d871077ae8c99446", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129169, "uuid": "f6372eef-c5cd-4d90-a6ef-17f1105241a9", "comment": "Malware payload", "value": "819d50a2fbcd33f126b8a38e4a5367207165a7433f48c65b102814ebfacbc213dd0e79208e57d24a9de047d06ed52800", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129169, "uuid": "8f2e67fc-bd48-427b-a605-f21015b48ee7", "value": "D214BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129169, "uuid": "eaac725c-aec9-4e35-b5ec-bd19d0e47984", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129169, "uuid": "dc906f27-0796-42ea-94d7-a675a6840c4a", "value": "3072:r3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:rJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129169, "uuid": "18882e2a-5ec8-44b5-a2e3-4124a5be50fa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129169, "uuid": "1fa7483b-39ea-4ecf-b49b-98eddd616370", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129169, "uuid": "a472593b-1b4c-4e79-820d-529baf9b9977", "value": "108067c498b6194d78e5c3dfeaf52cfbbead6a2456b0a954c18695c9dcfa7a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec054784-9104-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617073589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617073589, "uuid": "a67a5720-4850-46ea-855d-3ba0c22cd400", "comment": "Malware payload (Loki)", "value": "a81ffc7a9467c496d8a44e7246f5f40b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617073589, "uuid": "a91df2e0-08df-4a52-b8e4-d0893a5736d9", "comment": "Malware payload (Loki)", "value": "109d2dbcf9d28756a72916656e9bdb5ae5e05ca6a8fa9323c2096b5b6a351282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617073589, "uuid": "ba5caa03-c5e8-454c-843e-1003af0490d9", "comment": "Malware payload (Loki)", "value": "2857ad27df646a731d201d23fbcd02e1d58a250a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617073589, "uuid": "d78ea6ad-4b02-40dc-91e2-d9f12bcb8539", "comment": "Malware payload (Loki)", "value": "b705ce08165b48b88b3105ccf7e4e0c7f04024f703e2df41c953495d69450ead7da878d9d7f02b340fd750fb14b8a03a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617073589, "uuid": "8cd321e1-d058-4734-91b2-42361183996f", "value": "7CC461A870AE009DEEB46724F9B565821FC815321F62FF3F28E667001C63779F95E918", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617073589, "uuid": "1b8b4598-2e9f-486c-a8c6-cb80c0fe5a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617073589, "uuid": "35e60a65-0a4f-4358-a8b5-47918f6ab464", "value": "6144:ga6O1ggHm7jjzAMFpH1nKtm1j+eo7z3BA/CyZ3TLFlJMkKQm0umL7dov2wXsAgUy:cOYj0WH1nK81aesxgjhnLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617073589, "uuid": "fc61e1a1-41a6-483f-aa1a-c8c0660cbd09", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617073589, "uuid": "9e614e36-fcd8-4d8d-bf05-01842d4b1ed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617073589, "uuid": "45110939-e770-4b55-93a4-2ce5d4d99fed", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad30146-912a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617089720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089720, "uuid": "00b63e67-9568-4694-90e8-da557a11fe90", "comment": "Malware payload (AgentTesla)", "value": "cd8b29f6b01e7c9b22e910a8dd82a1d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089720, "uuid": "439bd4f2-9eff-4149-a4f5-94bd61b323dd", "comment": "Malware payload (AgentTesla)", "value": "10e11ba4d54aa4219160cf1dc6e124bd697e91cfb85d23b170fdb74d1ac45c6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089720, "uuid": "f4ed8bdc-1430-4a88-a5d4-3d7c6ab22a0f", "comment": "Malware payload (AgentTesla)", "value": "8eacc79578c3c13d8854a851750524dd5dfccbfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089720, "uuid": "61f3775b-d478-4f6f-bd3a-c9561a496c70", "comment": "Malware payload (AgentTesla)", "value": "f379cced709940a0f2c91d6b3363dea0e1a42573cbcb7b87358ef826d50ced96d32160d3f8a19222744e33c3e38dabd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089720, "uuid": "ecf21e42-dd56-472a-ad1a-239bcdce6f31", "value": "7CD491A870AE405DEEB46B34F5B555821FC925321F62FF3F28E257005CA3B69FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089720, "uuid": "c88e44f2-732b-4bad-902b-55a7cc6d56b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089720, "uuid": "ea97f0e4-3bc6-4183-bfbb-20025895767b", "value": "12288:tqcUszZ91zkyAkvBm0RABfbrrjUrnyGOC:tqctZTzykpm0SBfvUrnyGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617089720, "uuid": "48ba28e2-f8bb-476f-8703-47c820182114", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617089720, "uuid": "a38dee5b-cfd7-4b56-b2e2-cd43d762022f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089720, "uuid": "f28fc1b9-f73d-465c-a2f6-521b88338802", "value": "zco70Y2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe5529f6-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617085645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085645, "uuid": "abba1a55-ca99-42c2-8918-62319300883e", "comment": "Malware payload", "value": "b4268b7d10e74fcd07a5dc96aa21e7c6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085645, "uuid": "cf2f286f-afad-4df4-8f2d-d0501bb00ef7", "comment": "Malware payload", "value": "1120c91212c993d4efbb61d48f44ef3028be349ac4f53494f2a01b7f6de22bbf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085645, "uuid": "25326337-ad6d-4791-b90c-08336f8bcadb", "comment": "Malware payload", "value": "ccbcdbc30ff6dc8bccf02293e64dd0c6f7ed6870", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085645, "uuid": "4f816469-e606-4485-8d73-2b22ead973f7", "comment": "Malware payload", "value": "62b807d43c4b54547c9d749b82df083d93ec51868b93280f53300bf1dfa8f14549f51780d6f5fab4d1e784c4e025a9b1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085645, "uuid": "dbb8b206-0efa-468a-82cf-890c28bebd23", "value": "2C7533AF4007352C4484FEF14146AE256E96682ECBDAEDD377F002EB4D468A5B72F1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085645, "uuid": "f5941fe6-f021-4ee8-84d3-81acd0c597a1", "value": "49152:xDoi9fqgVsDPllXlFQFsseHzs8DkESaO4BQRfVQ:6OfglrbskwEmb9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085645, "uuid": "0df5df6a-9a09-48b0-8081-c1927324e5c6", "value": 1623613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085645, "uuid": "ac9ad9f7-1a41-47da-a60c-1e7f64213159", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085645, "uuid": "85699b9b-d95f-45e6-a5ab-aebdaf38f246", "value": "quotation5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46089e2a-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "92be6f9e-1d93-4cca-9e99-e1b1d084dedd", "comment": "Malware payload (Dridex)", "value": "ab6c7692ca736649f308e718f1fb57dc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "aebd864a-1e9e-4593-b59f-3bb30b23e75f", "comment": "Malware payload (Dridex)", "value": "1133587b7525fd7e3df2d05e1bed16d4b55bf496eac3dd879019960f9ab6c7c6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "4634a5c3-6667-4e0b-a0df-0757fef27ddf", "comment": "Malware payload (Dridex)", "value": "39e7896dc6d0fae4eac9bc7501d75c9113af6bf7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "9deed83d-ab4a-42a8-ab79-2fe0c1a113e8", "comment": "Malware payload (Dridex)", "value": "bcbfaee403b7323f98947fdbc1fe032b4a1faefc9ab38f60b36d18ee3183344ccf3d278118c6c3392e8349e26d73b2c9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "ed966d88-7608-4f9c-828e-1f3bf20e7c46", "value": "4D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "2d736c7e-ac6f-49c3-aced-1d7942141753", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "092676c8-b9cc-42d4-8dae-b37620d7c9db", "value": "3072:R3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:JJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114112, "uuid": "32877d79-1bb1-4d71-b24a-9a6b8b2276dc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114112, "uuid": "97a57ac2-58c3-4b49-aa20-8725f716eb7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "a09bd17b-9118-480d-985d-f481ee767d36", "value": "1133587b7525fd7e3df2d05e1bed16d4b55bf496eac3dd879019960f9ab6c7c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca559f4-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118230, "uuid": "f0be3b89-a1b6-442d-be73-6845991317e4", "comment": "Malware payload (IcedID)", "value": "420ee5628a1263b9c08fc4841f1d1e27", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118230, "uuid": "694ea6e1-3a4f-49fb-a6e3-8a23d3332123", "comment": "Malware payload (IcedID)", "value": "1190085c16225f6f2aa2d08a66d44b230b1c1816473e30f1106e98de71499b29", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118230, "uuid": "c5093eb1-e994-4d94-b2aa-ce47c611ecb9", "comment": "Malware payload (IcedID)", "value": "fe8a57bd1aad70fec36087d3a9429e90c4253f1e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118230, "uuid": "3dc81b73-3e31-493c-a519-89c87dbe5259", "comment": "Malware payload (IcedID)", "value": "c56f8e90edafb474b7b9f47342d1a978879faf598ee9166c34bcabaae1c53cf2e35253d229f8c44a5d3bd58d6c0c836a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118230, "uuid": "45c60e49-16f3-47bf-b5ae-334fc18c3f91", "value": "34B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118230, "uuid": "2d5dace8-cd2d-4717-b1c4-78ce1dc4ff16", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118230, "uuid": "e8e1b7a7-798c-4fdb-8219-a70d88c8173d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118230, "uuid": "63b5009c-45a3-4970-9246-66592d8fcb1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118230, "uuid": "7b24eef6-31a1-4f3e-afc7-172fbac12b92", "value": "document-127877882.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9c8a4d-9142-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617099975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099975, "uuid": "fb38254f-5719-4af1-986f-2aebcbe542d5", "comment": "Malware payload (AgentTesla)", "value": "1a88fdacb6575622fcf23a3521a6330f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099975, "uuid": "c320e058-0b1c-474c-9d1b-97fff4f20b14", "comment": "Malware payload (AgentTesla)", "value": "11c19768738fae9afb69692aa3049a1d8b831cd22cb0b74543dc130812b4e307", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099975, "uuid": "ce7748c7-6380-4e07-9ee4-78eab91cc6e2", "comment": "Malware payload (AgentTesla)", "value": "4bee0effe0de3814588e92c46afab05f8169bbb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099975, "uuid": "fafc1ab5-2438-4cfa-8fe7-937df7bfd613", "comment": "Malware payload (AgentTesla)", "value": "9ede94097053c69dd202b415c212e0c9ef184b93fee8c2418aa5e19c803e737f3632ac6fc6f818160545a2970cafa1c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099975, "uuid": "c80bdaf4-3cbe-4e6e-bc95-49b7ce275040", "value": "1F942364D82855D07E7CBCE22A28AC6DBD20DD5F05684FECBA0FCA93C84C97794B0391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099975, "uuid": "69547053-55e3-4dba-9c47-10290d94550c", "value": "12288:8zNjYlXHgM5kM6IubOrXbiPrtog966f38yk:IY9HZr6Jbnpogf38yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617099975, "uuid": "58392ab4-de08-4509-a173-713872fd2169", "value": 442200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617099975, "uuid": "a7434d02-9b9f-4d42-bf85-2a86240fab9f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099975, "uuid": "74f5ff4a-ce4e-482c-a1a5-8b9ac22f23d6", "value": "Purchase Order 2021 - 00062.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "172be6bb-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115322, "uuid": "2c22a2ce-4657-42ec-bae4-53945bae9c90", "comment": "Malware payload (Dridex)", "value": "40f0ed4a199c0442adc9ad5833279f72", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115322, "uuid": "df05f41a-c18a-4e50-acf9-65fd20105161", "comment": "Malware payload (Dridex)", "value": "11cd3ab9a042535ac8e7f5b1eb9b3e228e7016c05c701bb18ecae34bfd04615c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115322, "uuid": "b433b743-3a82-49f0-9db4-5e8822e86b23", "comment": "Malware payload (Dridex)", "value": "3da9cc3bb7a5f962e3b8a896c90fbc96d1a98ba6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115322, "uuid": "247eb02c-38fc-42e1-b427-282fd03c040e", "comment": "Malware payload (Dridex)", "value": "64e4c503587434a5feec096b92936c399ede4202d81b99a386de8e6d0b3c8b38b66144190b8e6787960b207a1f7971be", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115322, "uuid": "3febfde0-1d1b-4532-a44a-3ff15fa82aff", "value": "1814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115322, "uuid": "c7fcfcc0-d26e-4166-8952-910acad30131", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115322, "uuid": "ac0c4343-c871-41fa-acce-3d9a1701edbd", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115322, "uuid": "9bd33754-c3f7-4173-a023-a3d4c2f0294c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115322, "uuid": "7362d2b5-8395-45bc-98ed-0b2064a1b0a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115322, "uuid": "891ad503-e8e3-46c3-97b8-334f2052a700", "value": "11cd3ab9a042535ac8e7f5b1eb9b3e228e7016c05c701bb18ecae34bfd04615c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca488e3-917d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617125183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125183, "uuid": "b87de9e9-dafa-4fcf-85b1-1d717665d2e0", "comment": "Malware payload (Dridex)", "value": "a3f66c6edf4924b0b6da4c5fc6f7b50a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125183, "uuid": "ac7ae744-997e-4382-9668-4a27709f6f97", "comment": "Malware payload (Dridex)", "value": "120b400c5a8ccf34e58e385a6528c819a5aa3ec15120df9ecec1f850275dfed4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125183, "uuid": "a3e0c9ab-0340-4de0-a508-1ff82afc1672", "comment": "Malware payload (Dridex)", "value": "1cccc451e8bd102b2d9cdb53b0d9ce970e27d610", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125183, "uuid": "f91a012d-9d9d-452e-8af2-21299b9915e0", "comment": "Malware payload (Dridex)", "value": "fe4f59e4fc0f55671ef9fa6b49c02103a8d43d4d35e899be04e2df0297da64ba35b4985742dcce45d0af86980df46e1a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125183, "uuid": "3eaf3e0a-7823-4088-a5f0-1c3520bc9e61", "value": "B714AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125183, "uuid": "995dcff7-41e3-4926-964f-d2e7d021b0f4", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125183, "uuid": "30cf10e7-d00e-4ac9-ba59-e914b051c2b4", "value": "3072:K1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Si78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125183, "uuid": "e54f9a98-4627-40ac-8ae6-f3f736e89442", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125183, "uuid": "69d4c680-780e-4ec1-90bf-deaf69ad4074", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125183, "uuid": "9374f303-2c52-4469-8206-d7c1990260c1", "value": "120b400c5a8ccf34e58e385a6528c819a5aa3ec15120df9ecec1f850275dfed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d9a273-9124-11eb-abe1-42010a9c0039", "comment": "Malware payload (Smoke Loader)", "timestamp": 1617087237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087237, "uuid": "87df348f-743e-4c95-87d6-5b3cfc5d8f65", "comment": "Malware payload (Smoke Loader)", "value": "9e2ab0c40891401ad3b288c30404e204", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087237, "uuid": "44d50f37-d60d-4ec4-9088-9836cd518abf", "comment": "Malware payload (Smoke Loader)", "value": "1230b03108553f58a87bbb29f13d91117d439412f7c121297c58bb9860c7770d", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087237, "uuid": "25b81852-2733-4e57-9dac-9711cf29a0b6", "comment": "Malware payload (Smoke Loader)", "value": "2c5fd142220ff44b2bfccbae72cc3085b797a4fe", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087237, "uuid": "d4d1c4f2-e370-441d-8991-e020fcf0e063", "comment": "Malware payload (Smoke Loader)", "value": "870b636b55d573170e6d0442e0a6eb24b9a6934886981e6193454c586946e246c4e18228a8141a2461e4fdce72e634cf", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087237, "uuid": "c2a2081f-3a07-4768-9fd9-8ee14d9f58a7", "value": "8F058B0273D1C036FFABA2739B6AF60156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087237, "uuid": "4aa797f0-3f55-45a8-8222-359498bce52f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087237, "uuid": "52cfb8b7-5014-4fe5-8d02-8d5d99f3d414", "value": "24576:2AHnh+eWsN3skA4RV1Hom2KXMmHarda5:Rh+ZkldoPK8Yar6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087237, "uuid": "55c2f1f3-1e8e-4386-9b29-24522d44bfc6", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087237, "uuid": "4446f8b3-c4fe-46e6-8222-eef44b64cfc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087237, "uuid": "460db292-fa41-4514-8214-200aafa66b22", "value": "9e2ab0c40891401ad3b288c30404e204.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414afa06-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "f1b30650-7cc1-4181-895f-5aea817b1c63", "comment": "Malware payload (Dridex)", "value": "f879107ef309c6f96e940866afcaaaa1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "40b79064-d569-4024-9540-52e6159e3806", "comment": "Malware payload (Dridex)", "value": "12537e70dbf34d20e0680c8c2b5e83edd1c940e3d3725f93985444eb9c7fd899", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "581297b6-eca6-480d-bffe-3c2125431f11", "comment": "Malware payload (Dridex)", "value": "daf72c6c697f48fec046f49142d7496a518557da", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "f130189e-0b1c-4584-ae6e-9656f2bd7999", "comment": "Malware payload (Dridex)", "value": "6c881ef43148a3c01578e579d721d239e0798eb0073801f579f99dce94b794b1cd018d2596a38f4d3ccf4da5ad2462c7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "378c0065-67e8-4d2e-8fca-8d098f0d581e", "value": "8714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "4a158524-cccd-4f78-8a34-aa9f28478ac2", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "9fbb27ad-7111-4875-bee9-ecf18805d167", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114104, "uuid": "d023c365-9c9a-4a02-be64-b9caed3f7076", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114104, "uuid": "57bd85ac-9611-4c84-b35d-c16b0f4de7ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "e199c179-dccf-452c-a477-5a93905e5b4b", "value": "12537e70dbf34d20e0680c8c2b5e83edd1c940e3d3725f93985444eb9c7fd899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8988e469-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (CryptBot)", "timestamp": 1617088456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088456, "uuid": "d6022435-c15b-4e83-abe5-9539dcd8ba34", "comment": "Malware payload (CryptBot)", "value": "fcf7a9f612586c76b3597985dc5e2b79", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088456, "uuid": "6c4b914b-c9f4-4d16-a494-4baf5488d617", "comment": "Malware payload (CryptBot)", "value": "126f515316ff7d1be06266adcbbd565f18437b293b690765dcf55f500cb048e0", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088456, "uuid": "59152019-ea1f-4e7e-b7c5-1b13b79191fb", "comment": "Malware payload (CryptBot)", "value": "4a75e27a1ed940a6f27f5f2bf316f7ebf95b0858", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088456, "uuid": "96cf5b38-7f7f-456a-937d-1e9ffacc2d80", "comment": "Malware payload (CryptBot)", "value": "bd1a0f14dde82d5912e45c03c45d52b40894f90a571dc7aa88adce64e44ba2778337f3a6b313ff09c3b05192191b1e55", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088456, "uuid": "fc9ba0b6-fc76-45ee-9847-89c12c13eeb3", "value": "DDD40222B6E1C032D52258750432D6750636FC729BB8AEC7BBD02BAE5F352C1C63675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088456, "uuid": "59342df7-e3be-46a8-8774-84caae3411b6", "value": "8d51505bd41d41cb00a4bb7b4e4cc380", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088456, "uuid": "b35c8cff-7788-493d-b1a0-78d8886eb0ad", "value": "12288:IYzF6Td1+9J+n2XUNABXFTNXAV7n5Nk6IqFCbutV7nrWm57G+:IsUdn2XvFRXAxnvk6IqFCijP57G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088456, "uuid": "08e1bae8-c2a5-4341-9521-e5c9f0e5e838", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088456, "uuid": "fdbc76fa-96d1-4868-b71d-af424524ceb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088456, "uuid": "ddd4ec32-82e9-4c8c-8a14-179dae8b4664", "value": "fcf7a9f612586c76b3597985dc5e2b79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddb7524-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "c1e8cb94-7878-4e48-a76b-07b5ab1bbf86", "comment": "Malware payload (Dridex)", "value": "2f79c2889dd1d932f7d71b62670324c3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "81605ab8-a13b-4c9f-85fe-8a4538dd63fb", "comment": "Malware payload (Dridex)", "value": "128422a9767f1f91d4aaf4ff9343e7e26cda31268eba3a89c55aabc00ba26333", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "617b67f3-5a57-4384-ae59-8691f477b483", "comment": "Malware payload (Dridex)", "value": "2b69c44bfd7e2976384f9cd28aeb4cce7bfa09db", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "0ce90a7a-49fb-4d45-ba8d-494f47f26264", "comment": "Malware payload (Dridex)", "value": "4b03b47f38281bf257c9f9010e37877008a5c4f8f6708062bd572af81ed429b5ee70810e81ccfe7b5fa7c3588905535d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "e7d3855c-b3f1-49c2-b5e5-c8e7be30cfe7", "value": "A814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "9c7f1ad4-4e5a-436e-ba7e-d425c98bbdad", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "729df538-c8f6-4756-aa8d-98478b231db0", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114072, "uuid": "65817b25-6a60-4b35-bbd5-a989e1d7cfd8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114072, "uuid": "f980c588-f8f2-4b74-be3c-6052b69acdf2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "e5a3111d-7799-4c98-bcd8-38234ac17463", "value": "128422a9767f1f91d4aaf4ff9343e7e26cda31268eba3a89c55aabc00ba26333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa29649e-91a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143620, "uuid": "b50473b6-b3bc-4b6a-b778-824293f99ad7", "comment": "Malware payload", "value": "8c3fffd192a29808b7a108e16bec92d8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143620, "uuid": "24701801-dde1-451a-8749-fca058825e71", "comment": "Malware payload", "value": "12e3ef994b52627931102de1efe29c033a6e7ed45825bdbe67585540a9501089", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143620, "uuid": "bcbf2f60-6072-4212-8c8c-ddf785733f17", "comment": "Malware payload", "value": "663013edd37ad776b30ab88d823210bcccd7cd63", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143620, "uuid": "e490fac3-eaca-46f1-bdbe-53bee3cd1b1e", "comment": "Malware payload", "value": "7ecb82f49d13bbb8f8f5420248d897c9210677de49dd7c4d972c65d0fbe1459ababd465716611dea0b576f45b0a3a669", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143620, "uuid": "67556795-823b-4fe7-af4c-ae175082f0f9", "value": "4E14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143620, "uuid": "3e27915b-e68a-40a8-a59e-6e7c183dae19", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143620, "uuid": "6a618b0d-4084-4752-8f53-242b92399939", "value": "3072:X1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:li78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143620, "uuid": "ea5b24b7-4676-4356-a8a6-33d2b683f12a", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143620, "uuid": "c0b09329-cf86-45ed-b776-057a5198aaef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143620, "uuid": "20973dd3-f53a-4042-8c13-59bdda2ccf2b", "value": "12e3ef994b52627931102de1efe29c033a6e7ed45825bdbe67585540a9501089", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94402c0c-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085467, "uuid": "01b3e7d8-212b-42d2-aaa7-e57a92c02989", "comment": "Malware payload (AgentTesla)", "value": "50660d28da5063cdf69a2e3b4aa7e1f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085467, "uuid": "5a0b571c-9bc6-4163-b04b-9db162f68c28", "comment": "Malware payload (AgentTesla)", "value": "13395354b7c8c45fb792fa003ebbd8c033a3bc028c90f34536e79a8d79d5da5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085467, "uuid": "170b18e8-5c13-4a69-9918-9447dfb46578", "comment": "Malware payload (AgentTesla)", "value": "3439769057e6b1b68146b1e8554977cc5fd9adc2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085467, "uuid": "56263c4e-6254-4629-8dfa-cc00a18186c5", "comment": "Malware payload (AgentTesla)", "value": "f31ef8bcbd66014affef24bc4e3043df1fa4a13c6a207dc4ce599b9cbd81b5faea845ab4ac4fea82b916f1b1a0242977", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085467, "uuid": "3b39d6d8-d8fa-453a-b479-2dfb633ae6e8", "value": "32B4E03E77646F9AC3190E3A88271D4883F0D3136232F6972FF96DD225A0F645B2E459", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085467, "uuid": "ce0f519a-1c25-4b0c-b9e0-c8d9f4031f18", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085467, "uuid": "3d8d2025-f754-4385-8e68-0726adf490c8", "value": "12288:WeJ42KiO5yvAioJexddHAPBeEt/RiLDzcSl:POTi9obgdHceqJiLDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085467, "uuid": "17663832-45aa-4313-9e6b-61a75d39c74c", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085467, "uuid": "a25b5f21-a555-4453-b456-9317ba295ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085467, "uuid": "4ffafc13-b081-4325-913b-ef9bd5b5cad8", "value": "PO-N0-7908.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21d1d1a-9185-11eb-abe1-42010a9c0039", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1617128923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128923, "uuid": "4112eb2d-1487-4700-a632-9b11f3fc94e4", "comment": "Malware payload (CoinMiner.XMRig)", "value": "4807d6b3bc3740ed58861f208470d076", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128923, "uuid": "773a1245-10ab-4290-80d0-d8546e7e2ead", "comment": "Malware payload (CoinMiner.XMRig)", "value": "133a86c10b14d53d0807901d3cd477b0e1f62b9351707fe82ded7fe19c1f7689", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128923, "uuid": "4b9d2400-a3c3-4617-807f-e5b72736f4a3", "comment": "Malware payload (CoinMiner.XMRig)", "value": "5efe5de43d28aeaa24c7065ce7113fd0c96f2539", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128923, "uuid": "b36e0ed6-b109-4511-94df-84fddc40a7de", "comment": "Malware payload (CoinMiner.XMRig)", "value": "b39219074a3ff9474661a6c2e56be3d51c21bdbb51609ef8a6d3b06866442838acbd949f31d2d677469f6d74e1ea15de", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128923, "uuid": "6cb4f4c1-49cb-499a-8fb5-e16bc1988980", "value": "44648B549108BAD2C8A925FB94C2B31C1926EE0434C59EC67ECF32791D397D1EEE7E48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128923, "uuid": "18ef198b-5b9e-4bd8-acae-49cb3cd9b5cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128923, "uuid": "3a43b718-b0e4-4a48-97b8-766056689a85", "value": "6144:nZ1RTEUo/zp+oXpynAq/KhAcylcn98L2VO:nbRwUGRkAqORn98T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128923, "uuid": "8e10501c-bc2f-475c-8f1b-75e047ce1805", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128923, "uuid": "71bb4329-ac0f-4e2a-8b0c-ec034c651674", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128923, "uuid": "7e6e9a59-253e-4e06-b349-b31aca71f7cc", "value": "133A86C10B14D53D0807901D3CD477B0E1F62B9351707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9727a8f5-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143884, "uuid": "35f46ec8-cc1c-4079-aaab-075874dc4518", "comment": "Malware payload", "value": "add1ede28206e52000dc78b1e9af8ab6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143884, "uuid": "1546d9c0-66fe-41b5-bab7-05c2d33657c6", "comment": "Malware payload", "value": "1388ab85e351b1520a7529bcf2d3f69d9d39bc086b326887b6000a6e6baef08e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143884, "uuid": "4f4ca7b6-9bb7-40c4-998c-4e3e6f2274da", "comment": "Malware payload", "value": "ca4da1736b558013f9260fecf0e9e1ba3587540f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143884, "uuid": "60bf1424-f1b2-4fb1-9756-dc5339de54ea", "comment": "Malware payload", "value": "bc614278a954d893d6c2d423084344a9394c13fb1f702787ad5a647668417f889f817ed143317298272b8b43270fc312", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143884, "uuid": "7e4eed3e-274f-465e-b034-b19c774ba524", "value": "B614BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD8C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143884, "uuid": "c398151f-a4fe-49a8-a73e-272cd747d382", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143884, "uuid": "d8cbae4f-05c8-473a-a498-0f0851a87c82", "value": "3072:B3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:ZJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143884, "uuid": "9c8a89af-b042-43df-98bc-0358e6ef8455", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143884, "uuid": "db6cfd89-57ce-45ef-ba09-9dd05c15b72e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143884, "uuid": "61a741c4-431d-4758-8a82-257819332897", "value": "1388ab85e351b1520a7529bcf2d3f69d9d39bc086b326887b6000a6e6baef08e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3669e60a-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123105, "uuid": "6e504460-bba9-4343-b63e-7b81a8b3f747", "comment": "Malware payload (IcedID)", "value": "1572b06b02ca6a284342debe7d6d2630", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123105, "uuid": "4e959770-6abb-4192-833d-a9e72754d926", "comment": "Malware payload (IcedID)", "value": "13ce7eab675d86bf19a8bd940b37d8b50e734019500ef43913479b5d5c6c2b33", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123105, "uuid": "f56d0aef-8140-4772-959c-fdca4df64e41", "comment": "Malware payload (IcedID)", "value": "83c1185020520c8c5ab91893c292b6e21988cd11", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123105, "uuid": "1e3471f0-391b-4685-9f46-162690a4ce97", "comment": "Malware payload (IcedID)", "value": "29e5e6769cb4c1cdf73e52c64a2218f8dd577e4c37a8ec51b3c1822f8229efd27dbdd9b5051f8ea70fd16d5928c32c13", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123105, "uuid": "0c119b69-4399-4028-9ff1-123ba3a97fc1", "value": "72B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123105, "uuid": "913ae743-6e58-4f60-b097-77835e24fbbc", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123105, "uuid": "35672996-b710-427d-8013-84d202d8908e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123105, "uuid": "769fcafe-ae7a-4dea-9b46-077c8b10d61c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123105, "uuid": "e95ef316-fbd4-421b-a1af-2f47b208fcf4", "value": "document-295016421.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0af0a34-9179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123740, "uuid": "9e227a9e-80d0-4cf9-a452-628e59be77c4", "comment": "Malware payload (Dridex)", "value": "beaa592a53ce3721b4279c642c3d0e58", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123740, "uuid": "a3dfd163-b790-4903-8042-44a4ee3ff4d1", "comment": "Malware payload (Dridex)", "value": "13e89dc665e0750e3574585845b72989ad673c8533c5dda300ab9080d1a3af78", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123740, "uuid": "5951f5e6-ed37-4814-a37a-53ce9a8391c6", "comment": "Malware payload (Dridex)", "value": "b66ff48da4344cd7d9a89911002a19f40fcee43d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123740, "uuid": "f64037d4-f903-46bd-b658-7adc7ce24733", "comment": "Malware payload (Dridex)", "value": "e94e8a34a6bee2f0952228c8a10f39e71024dafdd6aea56fe18366e6f52728724b079bcfbc74076354695f60b59812da", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123740, "uuid": "f5bb4621-ed6f-4c9d-9cd9-2d8fdc568063", "value": "BB14BE2DE333D495FFF7CAF41492AA2A8A7B2D40822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123740, "uuid": "1987332f-2f76-4296-875b-9d1c677b26e3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123740, "uuid": "055d5366-c768-4512-9546-383dc5e6f96b", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123740, "uuid": "fd86b683-48a4-4646-acaa-7ec59b20eb55", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123740, "uuid": "41ffc1e3-32da-4b45-8ad5-a043d41a73ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123740, "uuid": "050156a3-dd4e-4133-b6ae-e7eb3d1f0db5", "value": "13e89dc665e0750e3574585845b72989ad673c8533c5dda300ab9080d1a3af78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6a95b2-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127194, "uuid": "aefe3bb1-6b38-413f-8959-a5191c83fea1", "comment": "Malware payload (IcedID)", "value": "83ff72bdc1771ea3c203697bd61fe1c0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127194, "uuid": "60db31c4-0227-400d-a99b-f909eae98ad5", "comment": "Malware payload (IcedID)", "value": "14228748d22a12342250841b7a7cf4816fb3afc0f087a0b6b4a2141458bdf817", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127194, "uuid": "79e67fa7-e8aa-44f4-ba9d-111747cb055d", "comment": "Malware payload (IcedID)", "value": "30efdae5c8280ab42b75e52ca665712c26658642", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127194, "uuid": "3cd6a7ea-737d-45a3-948c-f761c4d05416", "comment": "Malware payload (IcedID)", "value": "7e70d9c59535cadb475708cca5dcf8d5b955efadcd4163c6ec5a54a12ae444187a0e7c97dd9af1cda5e2dcaa841e279a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127194, "uuid": "7d0fad91-10da-4757-b9f2-f2cdf6a55d47", "value": "62B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127194, "uuid": "4bafb26c-d747-4466-9356-fb920b15c960", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127194, "uuid": "f4bf94f9-c2b0-4b12-a753-0a1c8e785944", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127194, "uuid": "a282cd2c-6fbd-449f-abb2-98e6644a4412", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127194, "uuid": "303954eb-4337-486e-a110-ad60b583e357", "value": "document-1721046957.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2d8921-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617131623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131623, "uuid": "789c541a-d721-4bd2-b68b-305f130faaa4", "comment": "Malware payload (IcedID)", "value": "f6e397a895603e38410743a6a6ea856d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131623, "uuid": "ecf02818-d7b9-4c11-868d-40424fd0e2a2", "comment": "Malware payload (IcedID)", "value": "1438bdf6c2ec794ae2aec7e85c0e9eb9cc2a8cd66efcae5bada79149720ecc49", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131623, "uuid": "f351394f-f37f-4336-bdc8-c6ed75111882", "comment": "Malware payload (IcedID)", "value": "9d52d6343b6db292589cf55b0b8d98f9695bed1a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131623, "uuid": "364e8126-72cc-4b4e-ab37-6a08028a51b0", "comment": "Malware payload (IcedID)", "value": "73fb27387d478505c3759d8ae77930c10992ebd1c14869a3462066402337a09767e79274c1d8b5146e74e07b57157975", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131623, "uuid": "e7fd80a2-b3b9-4ad7-a9a1-cb3bec98c85b", "value": "E2B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131623, "uuid": "8b8214d7-c27f-4aa8-a9fd-8f126466eb5d", "value": "3072:Q2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:QzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131623, "uuid": "dd8beb46-6b72-4906-924a-9c99d48c08f7", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131623, "uuid": "186dacab-a833-4284-95ac-0e8f2d11890b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131623, "uuid": "f43b47a8-8bef-46d7-9d45-75d2e8c072b4", "value": "document-1216200656.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06604ecf-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106704, "uuid": "b0ab5303-9b70-4a64-bc16-87bddbf83516", "comment": "Malware payload (Formbook)", "value": "8f7cfc52d8d5901e9ff8cea6992e7444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106704, "uuid": "160c8237-13f9-46c7-93a5-f18da9242fe1", "comment": "Malware payload (Formbook)", "value": "144ba78ed9c55be4ae5cf35ce9dfa6ee728c8e3eec6ae24e86b63b16c259d772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106704, "uuid": "a2fdb24f-6572-4ee7-ac68-d803283929d1", "comment": "Malware payload (Formbook)", "value": "dd06131fb3e9bab781260e773a37f55454eefa39", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106704, "uuid": "e971a8f5-8ad8-405b-a156-92f1d09bebea", "comment": "Malware payload (Formbook)", "value": "d7249b7e97fef63b765585cf496e8d847083ee1c43ee296a9c80b781d4cb009ff8fe845efb217a3927ebb78689cc89f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106704, "uuid": "3559ae84-d37e-4f00-88a7-606831327af3", "value": "7CD4A3A870AE805DEEB46734F5B595821FC929321F52FF3F28A66B006C63779F94E410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106704, "uuid": "1cafeea6-c7c1-4933-b1a5-0f21e438c763", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106704, "uuid": "587700d5-90c6-4887-90f9-dfdec4a4c63e", "value": "12288:1Lup23xd7uyVBR56m897UHSShlus2TQyFO8:wp2db35nLyShl92hO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106704, "uuid": "a7fba301-249f-4a00-a8b6-a81d8934d2e5", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106704, "uuid": "7a9c9f8f-8482-44b0-8c98-65e02badd99d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106704, "uuid": "a596e093-5611-4c2a-91b0-36842107f62e", "value": "NEW-ORDER No-004353.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6fa423-918e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132883, "uuid": "17486208-e3fb-46e3-87f9-a77611bf2e87", "comment": "Malware payload", "value": "0c6c9f2fb056ed566b601fccf6dcdf47", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132883, "uuid": "4e2ffb7b-74af-40a9-b92c-f3e984addec3", "comment": "Malware payload", "value": "1451028b78f1e516d3308e6fc077ed7a2b1c09330c93927a168d3a68692929a2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132883, "uuid": "01b78a3c-5570-4fc2-8102-8a3901341bfb", "comment": "Malware payload", "value": "232e9a28e5fa76a5c8ab63e60691f296f20d4a7f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132883, "uuid": "6c69e0f3-c84f-4246-b832-0ebff5f71cf5", "comment": "Malware payload", "value": "9b66a8cb69f56ad73cb137dfeb5d4ce4352ad0384d18682cab5ffc6832bceb0d6f511709e11b22ee0214a8eaa08ccd3f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132883, "uuid": "71e8423d-9a1f-4850-8b78-cef1f4d5bf57", "value": "4014BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132883, "uuid": "64fa7e94-4492-45e2-89cb-908a1f0dc0a5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132883, "uuid": "39c876dc-7a83-4f46-90f1-6d84af0e0c38", "value": "3072:23PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:yJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132883, "uuid": "7bef8476-5ec0-41cb-b925-efb87190d715", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132883, "uuid": "ae1d4987-1029-41cc-96d0-48cd72c96a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132883, "uuid": "bc85bbb8-2900-4f70-9236-7c96b725931f", "value": "1451028b78f1e516d3308e6fc077ed7a2b1c09330c93927a168d3a68692929a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce1669c-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137397, "uuid": "68c06907-f91e-4ba6-8467-2978a6b2f2ac", "comment": "Malware payload", "value": "f13feee260e3c0b38e6878772c394bc9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137397, "uuid": "14b1266f-efa4-47a5-86dc-5598b968859e", "comment": "Malware payload", "value": "14ace66bd873dec0a32c61726fcb3bcc6738dc965a54fed55c69dc71edcbc32f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137397, "uuid": "195d35a1-e829-4e2a-a54f-14d905a932b0", "comment": "Malware payload", "value": "bb3ffb42fdec518bdf948be3694bb81c07f9b777", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137397, "uuid": "f4132e1e-f58d-4ec2-8018-f2d5b5d16ed5", "comment": "Malware payload", "value": "af5378e0d687b1299f7a52d33590915e2fa1ab9da4473336d10168b44772317796d3eadfb3f771a9d5484b78e508adad", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137397, "uuid": "e699321f-fa7c-4d8e-bc89-8ad294bafb71", "value": "8614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137397, "uuid": "329643a5-618e-45a7-8c56-30d8daafef5e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137397, "uuid": "57dd0389-08f0-4681-9188-a16f208c0158", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137397, "uuid": "fd926d78-d8e7-469f-a4c4-d9606cb007e5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137397, "uuid": "feab579c-1f5c-4649-8d85-ff5bb480f999", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137397, "uuid": "254096e7-b400-401f-b33e-40ebd1bd2eee", "value": "14ace66bd873dec0a32c61726fcb3bcc6738dc965a54fed55c69dc71edcbc32f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc0d6bc9-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121290, "uuid": "106c8085-78d7-4521-96f9-8366d896c8de", "comment": "Malware payload (IcedID)", "value": "382d3d8ca7e78bc216eb4925ffc5894e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121290, "uuid": "17bf2056-d571-4ece-9b4b-97ee2931d5c9", "comment": "Malware payload (IcedID)", "value": "14b50bfa149def72f5dc08d27dfff8bd0204d8b8e28c0757327ea1189414c130", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121290, "uuid": "9d413cc8-388c-4a07-bc84-8cb999036b2e", "comment": "Malware payload (IcedID)", "value": "d46dfda040f552cbda4104ee4eebd76be330d4be", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121290, "uuid": "81ece0b7-452e-4b89-8b7c-ce9336456e98", "comment": "Malware payload (IcedID)", "value": "f9fc39532040b4bec53666619dfe4e2d8f44f8efa0c6373effb97f6ae2639c957cf72b000ee956f81c4d984433c6bed6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121290, "uuid": "ea8b1e0f-dac4-4f5c-9b4a-2d5de764fbd4", "value": "D0B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121290, "uuid": "4ac331c9-2ef6-466b-84e9-b171f786c57c", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121290, "uuid": "ca546b85-f35d-4b33-a5c7-2b9285d760d5", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121290, "uuid": "1f7f49ff-f4c3-4d85-aa6c-aa12c6e3b3e4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121290, "uuid": "7bf92363-b0bf-44c1-8ae2-cc49a1d939c6", "value": "document-1323558065.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4114f959-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "e7754c1e-a3e8-4571-ba9a-c500ff61bca0", "comment": "Malware payload (Dridex)", "value": "f4d32e49e287d04a9bb5030a40d5b555", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "051aaeba-17fa-47e0-bad6-fee56ceabf52", "comment": "Malware payload (Dridex)", "value": "14f393346bb8450e7fc2447fc567f259d5f86bd4b3f80b438307de3ba7bcab03", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "dc2d03e7-49ef-47df-8d75-b0fe48e5ca86", "comment": "Malware payload (Dridex)", "value": "1635ae147a4c849a4f2352d274ab71d739056f7a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "9a5858ae-9388-4439-af13-0c0b7a8843f4", "comment": "Malware payload (Dridex)", "value": "d4e2edf165540ed6c5209137ef5e936d4ffa7016c8f45e84cfe7e5450d460da70af8daafec8fde4714f246577da67355", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "53f80489-6cde-41c6-960f-6663fc3b5207", "value": "3714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "08f09bdc-9a0b-42e9-a9c2-79d1deb8a465", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "e1655f87-e4ae-4872-ba1f-f3ed985bb205", "value": "3072:H3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:fJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114104, "uuid": "065ff4a5-b34e-4652-a39c-44102f6b030a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114104, "uuid": "9136422b-3b73-48c3-816b-4dd3a40daabf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "0685916e-50bc-48b3-a275-98c1c038167b", "value": "14f393346bb8450e7fc2447fc567f259d5f86bd4b3f80b438307de3ba7bcab03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e4f9033-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085457, "uuid": "9f58325f-0695-4465-b263-c942c0431535", "comment": "Malware payload (AgentTesla)", "value": "58f2bbb9028285d64f379f5c288689b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085457, "uuid": "be42237c-4a94-431c-892f-c1a7982e124e", "comment": "Malware payload (AgentTesla)", "value": "15869d166a0a2a30dd5b148aa202bfd4147fe314cf5f1fd673cec81f3bba9d02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085457, "uuid": "76d69b65-8aa8-4d83-b301-2dafcd9c1f2d", "comment": "Malware payload (AgentTesla)", "value": "695274ff75e44a7cded91620ba3cee1d4a28eb6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085457, "uuid": "e5ef3c94-a3c2-4a0f-b8c7-b80d032ed7e3", "comment": "Malware payload (AgentTesla)", "value": "480973de3ce04708aaf7fb34e34579dc3fa17652a2fd45fe4bfaa09a28e96232c25d64489bbde4d5af71a63e5c624638", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085457, "uuid": "76e2d3e3-d989-4989-9071-6e3c6014dafa", "value": "B12512B03988DBD0E27E6BFE9425140153B8F7E26023DB8C9E89F8DA195AF4D0DC5647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085457, "uuid": "d31d5385-3135-4859-b68f-bbe364a7dd4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085457, "uuid": "3d75e1af-5d1a-4884-8cfc-724360a45c78", "value": "24576:UI5nTmmaJFc05F2YYTXS/8HHocx3/nPb0Q0O1iWu:UAn7sWYYVocx3vPbAO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085457, "uuid": "7a2654ee-c239-429f-be83-7048433a80b8", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085457, "uuid": "896caac2-cdea-448b-8536-3c63a131fce3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085457, "uuid": "27cf0f3d-ffe6-483f-9f25-f33b6272d37f", "value": "jufcOL0ekdlPomW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348da532-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123102, "uuid": "bc3ea741-febb-4fd1-850e-1290660b1694", "comment": "Malware payload (IcedID)", "value": "65dff45373e1f1d6309055f95ad460fb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123102, "uuid": "f2efe9e5-86c2-456f-a94f-4ffe82a4e151", "comment": "Malware payload (IcedID)", "value": "15f4262c82cd6a12628a679eb44d7c43c89c852ca92d8382e9eb35eb13d6397f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123102, "uuid": "e85e7321-8314-406a-aa73-00e5445d5c02", "comment": "Malware payload (IcedID)", "value": "b7cbc19b147b03a5a36d5428bd140a579a223d52", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123102, "uuid": "60d7c7ef-10a3-480f-bf77-9959aa474ff8", "comment": "Malware payload (IcedID)", "value": "8b6c4d6321983b01ca13e6ee7e760181ab6d1c06cf5080f4fe821143f86c3f8bc0db467fff97d02ede36b948c790dcef", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123102, "uuid": "7d977dee-5142-4d8d-9901-4b90a6ea63a1", "value": "98B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123102, "uuid": "a3d1be53-c117-4dc0-a430-ee3f838573d3", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123102, "uuid": "c07d01b8-6e77-4231-90b7-c0728a9194d3", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123102, "uuid": "39be4c10-3d81-4a0a-854f-89ae7736a964", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123102, "uuid": "705b4322-f787-4b69-b6ba-fb9e37bcccaa", "value": "document-635285205.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f81f54d-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142448, "uuid": "27c371d2-3587-4380-9002-fc53e6fee31d", "comment": "Malware payload", "value": "3cb089e5879324f097d58d70ed57405b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142448, "uuid": "a02ea249-13eb-46e5-91b9-b6e720b4a97a", "comment": "Malware payload", "value": "1630eae11fdc73bbc459609b7071e632e82cd5ece46e16f61a116bd0cca2ee43", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142448, "uuid": "da46ffee-3707-4683-a9a1-157479ba69eb", "comment": "Malware payload", "value": "a2de5e4361042580ca7fa2021a73427050aece85", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142448, "uuid": "85285f0e-fb54-494b-9bb8-816a63876ea3", "comment": "Malware payload", "value": "cb6916b6f5ca7748c0894cb13075e897a073e8c0b08504cae1670ff551b05fc71601e0824f246cc00d89aa314a34d1c4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142448, "uuid": "f35ea7a2-1b2a-4489-8096-3d76adb9d7e0", "value": "9614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142448, "uuid": "04b77a00-c5a5-4e4d-ac17-eff4fea0e1da", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142448, "uuid": "93a252fe-2ad1-47aa-b66b-2642054b7009", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142448, "uuid": "b9531429-adc6-44a5-ae58-7667cae1c57c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142448, "uuid": "19d5177c-fcb5-4e21-b854-1151f840ef44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142448, "uuid": "951ff4c6-e45a-4cb3-9eb9-4180fa9a51d5", "value": "1630eae11fdc73bbc459609b7071e632e82cd5ece46e16f61a116bd0cca2ee43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd219d37-911e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617084677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084677, "uuid": "1fe8500e-4a65-412a-a45b-c260877955d1", "comment": "Malware payload (Formbook)", "value": "da7598cec7a08671b389fdc0f5066ba8", "object_relation": "md5", "Tag": [ { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084677, "uuid": "70606958-de82-4d5e-ac86-26d9482cda96", "comment": "Malware payload (Formbook)", "value": "16597a732d46dcc464fe325246a829cc7ce81293c629f32b068e23d21ddf2c4b", "object_relation": "sha256", "Tag": [ { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084677, "uuid": "bd2f6c5f-31c7-4187-97eb-03942d4415ed", "comment": "Malware payload (Formbook)", "value": "814b8339dd2f495e0116391fbe9624b2e750cb3e", "object_relation": "sha1", "Tag": [ { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084677, "uuid": "246eeb2e-63f9-4695-b5fd-3a43c3e2ea6d", "comment": "Malware payload (Formbook)", "value": "9708a54b938ba7ebc184c829cae32d25b52103065c0eb5fc8a6e319e62d1cfed8f554b6aa58b0c3a3ffb87eef06b4084", "object_relation": "sha3-384", "Tag": [ { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084677, "uuid": "131f0c0d-0f8d-46dd-9fa7-c67ebb9b8c42", "value": "FEC5332DD0E2DB87CA9DA2B6451E9820065D4B296724CC073368361AF3BD73967C737E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084677, "uuid": "e8711440-87de-4b24-9dca-c323cad7bcd1", "value": "49152:C2Rg1yaKj2YZPJVvDTR3ICiPkRq2tIEiK1ieONj3BHjDggBsXo:C2Rjj/JJFDT/iPkNxLO1xHjDjBsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617084677, "uuid": "f4e6e7ae-adb5-43ca-8d44-5703bb21c82f", "value": 2619904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617084677, "uuid": "fcf94983-7e57-4bf4-b269-11a5dbca56dd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084677, "uuid": "71c53119-a232-403c-85c5-a01cb0698683", "value": "invoice bank.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdc84c6-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108814, "uuid": "941bc55e-17e7-4036-ae8d-090c4957884d", "comment": "Malware payload (Quakbot)", "value": "1bfa86eb70539c7b10c54ce81474379e", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108814, "uuid": "68b9f5e5-9b67-477a-ba38-e2075372f5a6", "comment": "Malware payload (Quakbot)", "value": "1690d539f5b27c4bf8d0a988aac7c27bd7a0d1c86d01c253ec713962e4baf3cd", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108814, "uuid": "7ebcabee-be51-4d48-b92b-76135d2319b4", "comment": "Malware payload (Quakbot)", "value": "245131e2ed10b29bfeace6e8dc0449530269868b", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108814, "uuid": "4d97fe88-2672-4b02-816b-2f9ee7f0a4bb", "comment": "Malware payload (Quakbot)", "value": "6811b392ad28afe441e086592be7024497a728bbb2de086af6a9459d25be9254f41845712975122dea3dce823a52fbab", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108814, "uuid": "ba854719-9dca-48c7-a0dd-eabf7dce5fa2", "value": "4DB3CF8E6280795EC39FB53E5A42A8E71C574044E613B43F36B4BA0D51ED29B2F8E1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108814, "uuid": "e08b2f60-dc37-4637-af58-a89e0309e026", "value": "1536:VHVqON35W1w/+VAOucniGlv3ITv7xVMsigZEQNggMorCK2TEhMljZJi:NVxN35W11eGFYTdV/vEQSlcC5Lje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108814, "uuid": "dfe6b517-e2cc-41fa-8a48-f0ce0756d68c", "value": 108167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108814, "uuid": "75a2a285-6510-4173-9898-1e2718710aff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108814, "uuid": "2a427cad-148f-43d3-b463-438e3dd93c0a", "value": "operazione_226.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf05ead-918b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131488, "uuid": "e39d0bbf-09ea-435c-9f17-26e775b83944", "comment": "Malware payload", "value": "74f367c9b3ea4a42848bb4fcb9765722", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131488, "uuid": "8c6381ef-87dc-48b6-9fc6-4d09160c3311", "comment": "Malware payload", "value": "16d6b8ec3c994f7f30ee80e045853c3f8eb4e9cb71c051cc1cfa85b4d9313c92", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131488, "uuid": "bf2d80c6-9905-4b07-a659-06501a09ae61", "comment": "Malware payload", "value": "9b5d3a1324c1bddb094bb8153110ec31ff019492", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131488, "uuid": "9088a091-3ada-4746-9d2a-32e597126bc6", "comment": "Malware payload", "value": "5571ab764326c525d62d160a035a008c2ae5712677e1aba476a3c58a4b2cdf67e3303932d63168798cd86ae1658b71f3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131488, "uuid": "9a6340b7-da7f-4c5b-bc69-d81c1cef26b4", "value": "B714BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131488, "uuid": "5804e17b-3a8b-4f25-8b8e-e738bb07338d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131488, "uuid": "cc5d5e0a-11aa-4d8d-93e6-82731771949d", "value": "3072:j3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:DJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131488, "uuid": "1a84af1e-69d4-45d0-b622-2bf4000f4ddf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131488, "uuid": "17ca7086-e892-428f-81e2-388e7cb89e3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131488, "uuid": "a425bf85-ec31-4253-b1b9-3032c1faefa1", "value": "16d6b8ec3c994f7f30ee80e045853c3f8eb4e9cb71c051cc1cfa85b4d9313c92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48daf84d-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126572, "uuid": "28cf9f28-cfd9-46a0-967c-5c4246c913f1", "comment": "Malware payload", "value": "c8e44916a4f16b757468bf18706c40eb", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126572, "uuid": "b1848e32-19e8-4b2f-81fa-eb8526e1caf1", "comment": "Malware payload", "value": "177e2a7c06bb361de849d5503134ba94aeaa16e0985521b72d78e92280a8e668", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126572, "uuid": "264de51b-f562-4c73-a947-275c609837a0", "comment": "Malware payload", "value": "091d96f17c886740e87fc2b585dac494cf5fc581", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126572, "uuid": "34a87629-471e-494c-b53c-03fee5c94da8", "comment": "Malware payload", "value": "580c8a63a50dea282f858fddf0599cb6715315c449c7a68914bfa7a19931c05398dc2fa3361e2a38427e10baad15e5c8", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126572, "uuid": "1d16870e-f6b9-4146-9470-154c323991bd", "value": "F1A3E18E7284B54FE78FBA3F1457E8EB2C234454E226653F7971BB0A91D428B0F5A04D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126572, "uuid": "76306907-8d70-4dda-b73a-6270ccda1f78", "value": "1536:MlByeNbClwI1HpaDw2MXkTv7xVMsigZEQNggMorCK93mEN6Cf8:EX+w/DjTdV/vEQSlcC4JE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126572, "uuid": "fe670b87-34ae-48f1-b4be-9cccfdfd630a", "value": 107438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126572, "uuid": "2bac99b5-f632-464a-9493-aaa0b14d8e79", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126572, "uuid": "b106b00f-c657-471b-b732-22ccb35f2a01", "value": "impr_1996.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ee9690-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108532, "uuid": "57d30261-f21d-4766-86fa-99a1d141d346", "comment": "Malware payload", "value": "e8530091c4b3f59006d2ebe16f82583b", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108532, "uuid": "5dbe3ddf-b6b8-413e-8d45-520642adb2f1", "comment": "Malware payload", "value": "17ccc2a9d59f919844bcff4f7d736d9a53de81955c2bc80b4ffbb0fd5500815e", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108532, "uuid": "a6841fdb-8fd0-404e-b610-74eb4323bd91", "comment": "Malware payload", "value": "6d09a37b6511a7938085a3ed74ad05413c276ddf", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108532, "uuid": "5f8b2f23-8f72-41f0-b379-72e4b718ccbb", "comment": "Malware payload", "value": "ae28f0732d4e0a8129dabe9478fd9aa5e70b8dc21a6d670aebfd2a77d7f6a0e4bc2587884ae71edd0ccd727755e261f8", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108532, "uuid": "d9c4c81a-6d52-4867-99b7-c2d83775a2f0", "value": "2193025128FD3C4BFEAD37A82B0305CD53FA6640EA75A27C9426D3481D1D9791A0E2DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108532, "uuid": "b3075f35-7f51-4441-9f56-87743757be15", "value": "1536:oF66bN6PMZ0gOc+H1t1e5I6rv15n4tKgWzsb4EqtBF4mbAyK6q7TaTlZxtUQJQFE:H6VZ0A+f1e5I6rv1ieowtBFXbAZiTlVX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108532, "uuid": "53f7fe6c-f7b9-48a5-8b58-4efdbb7873b8", "value": 89751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108532, "uuid": "33bbc910-dafc-4b44-ba85-69e666e07400", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108532, "uuid": "9ef055d7-9f5f-47fa-a044-a4842af42b94", "value": "impr_48.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419d237f-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108521, "uuid": "62520a74-1d59-49ab-a59b-85df3f83a96b", "comment": "Malware payload", "value": "103b2ea9cf3ff582d6a2fa9d6663efad", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108521, "uuid": "925354cd-bdc7-49ba-84ba-4f7affd34dbc", "comment": "Malware payload", "value": "17d8a4334ede19e273d3b730f4239b3fe7874e116619aa803469247d0fe34f4c", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108521, "uuid": "b5b989f1-d77a-4d55-8a7a-765103501da2", "comment": "Malware payload", "value": "a0ad2b47652013ad9979634e22104f35bf2ea8a5", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108521, "uuid": "870febfb-bb32-4b3c-be32-df4127325136", "comment": "Malware payload", "value": "02e939712fac4d8aaefb80da41918b1f712e3f0e7f9931b82c8a5e70be3e4ed8c8fa5d06052311345aec0841a3eb682c", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108521, "uuid": "af71f1fb-78d2-4681-9c40-79c6708d2967", "value": "3E930250FD1F2E56A8643AD8AFFF0C71BF80389755A1F803B541114996F18B7D890E7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108521, "uuid": "c6eb4f2c-918a-4a5a-8242-c1a74274f232", "value": "1536:zIBWE/CyGOD6872SVwotKmskjIBn7nrf9hlKQPKeekM7s512wNO62qaeBO217KOa:ziCS6M2SHtKOjcTRh8QPK4512wEsXBO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108521, "uuid": "1a954efb-f4de-4b5a-a7af-7bc4195ae10b", "value": 90173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108521, "uuid": "61d27700-49cf-4f2e-a40b-78dc416e4c58", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108521, "uuid": "37c6cb36-582c-4807-a8a6-bdfef70ba566", "value": "fisc_2281.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd868078-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118232, "uuid": "9abb0947-faf4-49d2-b060-e633c77ef472", "comment": "Malware payload (IcedID)", "value": "196347339d61002c45d6710f8c914523", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118232, "uuid": "6f4f765d-4fea-4e32-abe2-893bcd8bcd62", "comment": "Malware payload (IcedID)", "value": "17f011bdb2d4355514573e4ececa13eb229cdb0af5e46388513ebd61e87a1d26", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118232, "uuid": "5b8a4401-f0dc-4022-b0ae-91e6ca04a8f4", "comment": "Malware payload (IcedID)", "value": "86ed732a8c5a93c70f95f7abc473ff55af8c7c7f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118232, "uuid": "9e08b1e5-97ff-409f-9952-f5cc0e3bd66a", "comment": "Malware payload (IcedID)", "value": "b7197b308792b960c6a4af83db83eff824d003ab9e28da7f9191665e15114b24269bc68239e7cdc9019d9957e2da8529", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118232, "uuid": "ba83f765-7ba3-4da7-b3ce-ba6fb1fe018c", "value": "62B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118232, "uuid": "529806a5-6f8d-47e3-936c-bd7b4cb452d7", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118232, "uuid": "39367e20-ba18-4654-bba1-13dd2303e987", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118232, "uuid": "4635d5d0-7180-4ce6-a6a5-fc67bb8901e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118232, "uuid": "7479d3c3-866c-4b21-81e4-95d76570e34e", "value": "document-292736159.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6743b4d-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108825, "uuid": "8fc70ca6-9f28-4eda-bfeb-8f5ba28b630c", "comment": "Malware payload (Quakbot)", "value": "b36df30dc509238422eb05955e181a9f", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108825, "uuid": "215964e5-2699-475d-9ee0-77f22f737f65", "comment": "Malware payload (Quakbot)", "value": "18407ed7a38c9d5f6c0b200234eaed581b416a639c3905116575b3945105e0ad", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108825, "uuid": "7af10afd-e511-4ed9-886a-db91a9a790da", "comment": "Malware payload (Quakbot)", "value": "1ef372b04a2241ceb1edd7ac6b8db950ab72c013", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108825, "uuid": "dc93d96b-b4ef-45a7-b128-e6c56ca501d3", "comment": "Malware payload (Quakbot)", "value": "9cd667f88e3a505c30bdbcbd0aa939b46aaa83481957585a5c27b737445e4b094ee72b426180ea25e96a0f38dc21161a", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108825, "uuid": "e2452c85-fb22-45e5-ad91-e35e5b79b5f9", "value": "F9C3C08E6250B55AC36FB43D5683A8E21C465085E953B02F35B4BE0D69EE1D32F8F1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108825, "uuid": "db654be0-c52f-454e-b3f3-32d85695de09", "value": "1536:AWhUmPoBGLkrSjrtTv7xVMsigZEQNggMorCK2s1w/+VAOucniGlvFNEQcwXv4mrR:AmwQL6gtTdV/vEQSlcCu11eGFrbWoW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108825, "uuid": "49599819-31e0-4e3f-8b3b-9c2216809894", "value": 127783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108825, "uuid": "51d25b17-c439-4790-8fd1-61c97bded671", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108825, "uuid": "6b31b339-2b51-49fd-b9f2-bbb07f84c90c", "value": "operazione_597.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b08162-90f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617067236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067236, "uuid": "edc52c78-a589-4cc9-b284-e63cafb2a0e6", "comment": "Malware payload (njrat)", "value": "f794a2b479b5df7571d9c79138eb73eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067236, "uuid": "8e85ceb6-f2d4-4e3b-9399-635219e6ff00", "comment": "Malware payload (njrat)", "value": "1858e8e2878d8a4a9dd2052cdc076c2b1dbca4e0419687e06df583a00ab6935f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067236, "uuid": "0fc5c5bd-d304-4824-93d2-d3d8899f8cdb", "comment": "Malware payload (njrat)", "value": "55b11be9883a188d61ae11656f1a17ec01affff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067236, "uuid": "7068ed7f-51f9-4065-9b76-c8f3975ab575", "comment": "Malware payload (njrat)", "value": "b5bb89d47441511565981321227761f21e615f238a190b06887d232ce927835347d995c665b7beb4c85f7b393300e14c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067236, "uuid": "ad1a67ca-e915-40c6-8125-ef0c6e184b7f", "value": "75B21A0E3FA98866C57C1774CAA5565003B491470423EE2FCDC564CBAFB3AD91D8CAF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067236, "uuid": "4fe1a62e-6009-4000-adf7-75adf8a22949", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067236, "uuid": "6d0fbc12-9a8d-4333-a338-75df62485dbe", "value": "384:6Q+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZtN:1LL6MVU0NRpcnuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617067236, "uuid": "7f4faf4a-b46f-4601-91f9-334543aa548e", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617067236, "uuid": "734346f7-eb13-46a6-befc-00e79c90d609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067236, "uuid": "edd11298-57a5-48cb-a896-c184428f1715", "value": "F794A2B479B5DF7571D9C79138EB73EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c7a5b4-9196-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135912, "uuid": "a3355b45-e638-4a0a-835e-19177a6163f5", "comment": "Malware payload", "value": "2a676bde4e36dee6c0448b4bbca65d64", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135912, "uuid": "10a9e064-6039-4049-a707-ddd5cbbed85f", "comment": "Malware payload", "value": "188aa70b9aab270947b06d6ec44bc7013eccf8af58883dbc82d0fa49e77d4ee8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135912, "uuid": "9cc5d7ca-0e8c-4de1-8564-212e924e70e4", "comment": "Malware payload", "value": "ad8104eb0ec10600b445b2c353778eeac359df45", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135912, "uuid": "d4adf76a-a381-4b5a-a6ec-fa85c4e1eafa", "comment": "Malware payload", "value": "4ca5dda68b2a6e7f36fd0178bd2a2c0f789759e08dbb810d58e7dc2508ebc4845c0cd77b3200f0887937a5228ac599b0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135912, "uuid": "18bb885e-0817-49a8-9730-dcb95bbb836d", "value": "FF14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD8C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135912, "uuid": "218adf02-7960-4f6f-9b99-6282d5122634", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135912, "uuid": "ebc617df-ec42-4047-a0cc-ae342157e85f", "value": "3072:w3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:UJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135912, "uuid": "8e91d785-a419-4add-bf32-4c1c1d49b7b3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135912, "uuid": "566db5e0-54b5-4310-becd-e151608e5e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135912, "uuid": "f6b83416-15e6-4778-b11a-c2cb91988c25", "value": "188aa70b9aab270947b06d6ec44bc7013eccf8af58883dbc82d0fa49e77d4ee8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad46621-910b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AZORult)", "timestamp": 1617076539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076539, "uuid": "0ae24a78-0518-407d-921a-02e95fbe46f8", "comment": "Malware payload (AZORult)", "value": "fba7413ae6b18607ebc8c1cf0bc511d3", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076539, "uuid": "74269965-e72a-4e85-91ac-28a98cbd9a00", "comment": "Malware payload (AZORult)", "value": "18cf3cfc3a758849f2e225bc1fe895e58cac98f3824c56d02bbc63ff7b4b5037", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076539, "uuid": "802dece8-03fc-4ebb-b7a9-fafb390bafef", "comment": "Malware payload (AZORult)", "value": "24cef9864d6f1e4f901f6877d04bae418514a8d1", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076539, "uuid": "1a68582e-1dfd-43cd-8dfa-56b92f2f956a", "comment": "Malware payload (AZORult)", "value": "c3da908fe3679625a10d397f91b5f69d517e4658107c0b7989ce137c909225308879ea209929d9a1c4316457c27914de", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076539, "uuid": "54bfe4ac-0e3d-4838-a548-a69a184360bc", "value": "2A932FE8BD9584D7E6ADFE78988118A2E638BCB73D01B617498671C3C3336D329C445E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076539, "uuid": "f4645362-ca1a-4804-a611-3b8785f456ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076539, "uuid": "beeb9011-ecfd-453c-a3d0-745952de31f7", "value": "1536:3I62s+SPT10jecyEeeYsKcfpXeibQHzVwzngGoZr:V2s+SZ0jeRrlDy2e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617076539, "uuid": "8b23e45e-13cd-47e6-acb6-10d92e442b3b", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617076539, "uuid": "143bf7ae-1c98-47d9-b6a2-23c5aa0abbda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076539, "uuid": "f1d54a88-6fb6-49fb-b849-ffcada259819", "value": "FBA7413AE6B18607EBC8C1CF0BC511D3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a857af9-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "6a50a544-9603-4b8e-b372-3d48d178d016", "comment": "Malware payload (Dridex)", "value": "20a8009cfa77b20b0c2dbd6c06dd55f5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "adb17055-f422-47df-82cd-389d4e004634", "comment": "Malware payload (Dridex)", "value": "19182da82f127cc238d92e75aae9ea92515109a249582d26c72dcacf4e419408", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "3264802c-aee2-438c-8c46-0aa37cc1846e", "comment": "Malware payload (Dridex)", "value": "5cde42ef15e26aa6bf82910ab3066eee3a074e0e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "02716c53-e939-4602-9532-7d2553956891", "comment": "Malware payload (Dridex)", "value": "e1bcedc5ea435acfd176690000ab4e1f41cee2f719dba5efa2e927535c0e9f34b594ad1b9320742dddf860987c97a95f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "3da685c5-57c2-470e-a906-72bb070eac4f", "value": "4114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "5c8e58b7-1797-4395-a721-664269ebc042", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "f66c1349-27cd-4250-bd56-95af8e6dff42", "value": "3072:z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:zJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114093, "uuid": "46bf9593-8618-4ca2-ad8b-18a5c3ba3fbc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114093, "uuid": "39b4b9a7-91c9-43c1-967f-e5662a823760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "5b120fd3-d73c-4845-a804-9089fecd6abb", "value": "19182da82f127cc238d92e75aae9ea92515109a249582d26c72dcacf4e419408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca48fb8-90f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1617066583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066583, "uuid": "21375ee2-e7cc-4054-8bc0-d9a0c1b3d983", "comment": "Malware payload (Mirai)", "value": "d67fd6808917030be0f46b960bbcf399", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066583, "uuid": "8515d357-a88f-44a6-a436-86c0a0f2c2e4", "comment": "Malware payload (Mirai)", "value": "1925f7a2b715b4af5ff66221447cc5ed135d1b9f9aff2dee8ea1acb62d0dc0a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066583, "uuid": "583d769c-afd8-4869-8cc2-e89cad4d6d44", "comment": "Malware payload (Mirai)", "value": "4436626e225873fda03a91278cd0ebf1c0872e91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066583, "uuid": "472610db-b83e-43c4-99bd-188d7a9a1d48", "comment": "Malware payload (Mirai)", "value": "589f80572f9d1f89adf226bc71bddfad66f86eccd3b5b995ce97a173fbde34a141bf927015c3a0e7a40632eff29987ee", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066583, "uuid": "b7eae9a6-5cac-4cc8-bc4f-d41ed9d4fc2a", "value": "5862E88DE8A19557C6C1A376FB2F468D3720B796E7DE730BC8028B506B8258B0F27941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066583, "uuid": "4e823ae6-ddea-46b9-9db3-2890f330547f", "value": "384:9SWoSRQaf2avBS6aFZoeaNTo+jG6DXR4dG/+E:MBgQLavBOFZoI+H94dGmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617066583, "uuid": "dc4566cc-931e-4cc7-ab84-fdbcb3bc7588", "value": 15124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617066583, "uuid": "bba00427-ec5a-4c76-9866-642c6785062b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066583, "uuid": "b9379734-0c56-4fe3-8701-538d49d3b5b0", "value": "SecuriteInfo.com.Linux.Mirai.BEG.32460.6782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5551f2b-9193-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617134915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134915, "uuid": "78293c4b-40ea-4db4-8ee5-f2043c6b7b24", "comment": "Malware payload", "value": "133662ce996d6ab80ad36dbed4e8b10f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134915, "uuid": "45936c30-6a0c-4293-9fb9-dfee552a0a58", "comment": "Malware payload", "value": "19288face60ff118663557ba4d5f7d8fd546ad078e1fab51047f93ffa82717f7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134915, "uuid": "776ceae8-49b7-4aae-a989-6f203a6f413b", "comment": "Malware payload", "value": "715a12586a0c45bcefdb4a921b3acc9bcc1cbc7b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134915, "uuid": "de2bb93b-5fa6-4ec6-bb6e-46d313890bea", "comment": "Malware payload", "value": "53820a160a315031045f9635e3fe4fad201ae4e66782885bd55c7c5a89e1f2e0c8fb4f0390634c6656d449a9a5d0e6f5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134915, "uuid": "0168a752-a529-4bb9-addb-c4b6c03552b7", "value": "C914BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134915, "uuid": "ed3866f0-0b68-4637-a0d0-1e4fd5d5ee1a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134915, "uuid": "977de64c-156e-455a-b670-808078d8bcf9", "value": "3072:F3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:FJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617134915, "uuid": "d5c72a74-a221-48a4-86f7-5e5c39eb2af3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617134915, "uuid": "8f5115b6-3e2b-4ece-a0f3-02dd3243dc63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134915, "uuid": "1c912e46-0516-443c-be73-ea9d27b2919a", "value": "19288face60ff118663557ba4d5f7d8fd546ad078e1fab51047f93ffa82717f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9850c9-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108726, "uuid": "02af7d95-82fb-4f04-8e69-d620acb279b2", "comment": "Malware payload (Quakbot)", "value": "2887e4c316b45a264718708bf836cf09", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108726, "uuid": "7fddc204-748e-47ce-9639-78bfe52337a1", "comment": "Malware payload (Quakbot)", "value": "19320c9d4c85fc5ad1e33c778aec87ff842d883d0297e1b9be93f635605dc804", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108726, "uuid": "8cf3087b-9378-4091-9435-2a785c7fa885", "comment": "Malware payload (Quakbot)", "value": "268ce2e7879cdcc89a72508fd382683e9cd38c51", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108726, "uuid": "097cd43b-e311-4344-a7b8-0ad1e75ceb3f", "comment": "Malware payload (Quakbot)", "value": "40b82dada37d68e4e18a160ede1752de32940364d723ecba916cfe6d9b3d0cb2f83c74d506dbb08a76610b46fc24dd4e", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108726, "uuid": "25db5eaf-55a2-4242-9df4-91d9b2f4a229", "value": "0BB3E18D7284750FC78FAA3E9A06B9EB0D530045E526757E3AF8BF0F91A42470F5A18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108726, "uuid": "9032fb10-63ef-4fff-be64-97d114356aca", "value": "1536:/91XwKz4mZvJf+5X+qIyHBTv7xVMsigZEQNggMorCKTebQW2wuNOFn5wCUU:/92lmZp+5XrI0TdV/vEQSlcC1ZFn5whU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108726, "uuid": "f00b5b0f-fff9-48db-a171-fd5b17b0567d", "value": 111914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108726, "uuid": "bd700400-6f80-4218-a118-fa47966fdd5e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108726, "uuid": "0c0e06d6-6797-44c1-88d1-068e1a017555", "value": "lista_24.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30159c86-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114075, "uuid": "4189f546-8818-4f89-9a00-c1f8068ca261", "comment": "Malware payload (Dridex)", "value": "9309fe1e9e3af7882bb27d50eb6543ae", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114075, "uuid": "e462c2e5-8aa2-4e3f-8e5f-9243dfe5417f", "comment": "Malware payload (Dridex)", "value": "198e0491d7583de51f660a497236ef54e259a8cb4f6e746914180d2c7b074986", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114075, "uuid": "8b6a2be2-c91d-4b0e-aca6-b79080ee2ad3", "comment": "Malware payload (Dridex)", "value": "5968cb93105c54c01558dc000b4e6a8c6afc1901", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114075, "uuid": "924f8ff7-fdca-4d3c-9446-762c99c72ac4", "comment": "Malware payload (Dridex)", "value": "26ee96fc4e9c8d82110adb201927dac826312e9fe3f770266bd38175ac4e283343e44781b35b006f363a71826f5f7dc3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114075, "uuid": "e09e5c6d-7ab3-42fb-869d-13fadbb70522", "value": "E714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114075, "uuid": "29316760-a072-4848-ab62-08db7ea443da", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114075, "uuid": "b9a9383b-de0c-4b53-9bc0-beeb46030b17", "value": "3072:u3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:KJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114075, "uuid": "b3033166-b102-4e2c-a936-32aee1882ddc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114075, "uuid": "003c4dd6-766b-4e86-b9fb-4cf191cc036a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114075, "uuid": "7e48a43a-84f0-4875-9aba-dca0623bb85f", "value": "198e0491d7583de51f660a497236ef54e259a8cb4f6e746914180d2c7b074986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a5506d-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "3fda8b2b-3944-4910-b435-a591adb80176", "comment": "Malware payload (Dridex)", "value": "4d5971715d0826af33ea46c3b24e0287", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "7eb938cb-d94b-437e-a0b4-fd9e4a450e22", "comment": "Malware payload (Dridex)", "value": "19d055cbcc0a1b4dce60c9746ebb3c74e81cfd43b4e5f8f5d307c9e93c99bc52", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "5fa5ead4-583c-4ef8-aac1-d2201b2fdebe", "comment": "Malware payload (Dridex)", "value": "63b44db68aa7dcde00d6613f59c16cd41260e0f2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "4a40ea0d-112e-4a25-b4df-5362feb5f1e3", "comment": "Malware payload (Dridex)", "value": "c87feb18336ad8402b9f0820049df00ab0dc9e6350fc7a6296e8a19bba2ed85dd9c6e7d6d7b97605fb0ccb576ca71e66", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "d3861cba-ceac-4760-9d98-50a45d7b9f4b", "value": "A814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "8c124cd5-a525-4d4f-891b-959cd32cf36d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "04c82fa8-3e03-44d4-8924-543feb7bf4b3", "value": "3072:o3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:MJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115266, "uuid": "01413e09-104c-4d26-bf31-28130c50761e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115266, "uuid": "a936d9be-e31f-4cd5-8a1a-60d6b36deab6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "19faf50e-f38f-4b1e-b3fb-3dd129966b05", "value": "19d055cbcc0a1b4dce60c9746ebb3c74e81cfd43b4e5f8f5d307c9e93c99bc52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9a67eb-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "86e1eded-bfed-48ea-ad47-537901c9bf74", "comment": "Malware payload (Dridex)", "value": "3eb2c0e8bf3a7cce51465cd412dc5951", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "fa89efe4-3809-47d8-b65d-0ec97cc4be62", "comment": "Malware payload (Dridex)", "value": "19f599865080f69c3d8286aa8eb4a04a761e61b38079e1fbf0c665f9782594c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "5a7b5fc1-8a95-4f8d-a97d-2e2333a8520f", "comment": "Malware payload (Dridex)", "value": "6341d216f8d04bdd9ef7b4f7126441c04bb8f0e9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "b8aeb44e-51a2-4efe-ac55-d61767b81c71", "comment": "Malware payload (Dridex)", "value": "3d537e0ea25fb46e3d696d962d8d318ac3adaac5631567451a79a70ffab26c638c5b94c6b683e83c7e5203761947c010", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "6f5443a6-c9e1-4029-af7f-66cb0d99bf3e", "value": "0D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "d2d67df9-f371-4cc3-a88a-178883cc3bbd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "fa23b0f0-79dd-435f-90d2-017180f417e1", "value": "3072:43PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:8Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114098, "uuid": "23d73821-ce51-4a42-b098-b8ce26bcf6db", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114098, "uuid": "c5cdc0a6-3571-4780-8538-eca5785d4cd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "32112168-80c4-42af-be35-aaabf30f694f", "value": "19f599865080f69c3d8286aa8eb4a04a761e61b38079e1fbf0c665f9782594c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69c0202-916d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118569, "uuid": "908ab5a0-ab2b-4c26-824d-3def9b7ca592", "comment": "Malware payload (IcedID)", "value": "8c5b66799a8fb36c41d9a64667c06eb7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118569, "uuid": "897f997e-51c8-454b-b277-839c8d23eb36", "comment": "Malware payload (IcedID)", "value": "19fce798c83a604c8968d2624c6edf25bbc3bfc6acfabe6b53e03c7b24051a73", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118569, "uuid": "d1801e73-306c-4604-9bc8-08f0f606393a", "comment": "Malware payload (IcedID)", "value": "895832e8b8286199c3336edf4c26b90118da8abf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118569, "uuid": "38b974dd-b16d-43ce-b9a1-0003a06bbec5", "comment": "Malware payload (IcedID)", "value": "5d6cf3dd3503a8bbf486056f33c13add5dbe40182f02b02ce54e503dac2545dfbefe45087b22f58b3a5996c5b8c595e3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118569, "uuid": "65973eea-82e5-466e-b4fe-92aeb9566b57", "value": "2BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118569, "uuid": "7fe8e5dc-b354-4e7d-a493-6ae0dbbf1c97", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118569, "uuid": "0f633eb5-e67d-49f1-a2f4-bf361b709d5e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118569, "uuid": "03398609-4c23-4acf-bce5-2d6dfd98e119", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118569, "uuid": "9fe892da-7105-42ee-bc3b-d3e17183f3bc", "value": "document-519685529.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d39dc31-913f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617098797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098797, "uuid": "da5111e7-5fd8-4364-aa20-402b1be08062", "comment": "Malware payload (Dridex)", "value": "93c071ae7fe2f93d963799d7c0f431a5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098797, "uuid": "83d80089-0066-4d6d-8d96-7ac6529d258b", "comment": "Malware payload (Dridex)", "value": "1a172b3ee473c52ea235ad66b9bc918ea5666c975619c76b0dabb1c2cba85a0b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098797, "uuid": "ea9ef65e-af12-4f5e-8ec0-85e4e274913f", "comment": "Malware payload (Dridex)", "value": "c640af51f88b15a84578116f7eb9fe56da883884", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098797, "uuid": "2215a7e5-a1dd-486d-954a-965374a2ab90", "comment": "Malware payload (Dridex)", "value": "c9583f10fd950749fdd423f3f7b6071dfcafebecce0a057a94fbf68217f6353287335cec72b56e174f585d77f824746d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098797, "uuid": "6ba1ece9-8fcb-4169-8310-f1c882900f41", "value": "1214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098797, "uuid": "e5a5f254-ff15-4a70-aa7a-15e9e5d6638c", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098797, "uuid": "ae7bd641-26f6-48b7-862b-e03ecf1c1d22", "value": "3072:t1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:/i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617098797, "uuid": "37beacfb-83a9-4b51-b485-8ce1277bafd6", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617098797, "uuid": "0695cf41-bf62-449f-9ecf-010bdb3c84be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098797, "uuid": "b47066e1-1491-46ce-a889-b9e19b7adbd9", "value": "1a172b3ee473c52ea235ad66b9bc918ea5666c975619c76b0dabb1c2cba85a0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "466f359a-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115401, "uuid": "1ae3c548-0e64-485a-9be6-660d80e62af0", "comment": "Malware payload (Dridex)", "value": "25b2ab8c7264ef6fd6e77c0856d5bcb4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115401, "uuid": "e9ababbd-179a-4000-bcfd-a2df76c84afb", "comment": "Malware payload (Dridex)", "value": "1a30f52e5168fba73171a72751b982b8b5254403ef258f2455600cc22a487d6a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115401, "uuid": "0ed9b99b-b670-4a92-9cba-2a5a26d03a58", "comment": "Malware payload (Dridex)", "value": "7fc148a09916933fd44b80cfc246570dc6154342", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115401, "uuid": "ee9a8789-79b4-47bf-8c07-0d22b2da61b0", "comment": "Malware payload (Dridex)", "value": "df9fb05bf1b60ef077a785246ef9819b4d794ec7c3d5ae0dde65b383a7b7efba51aee1cae4e001c2015799435c2707bb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115401, "uuid": "2bd4fa60-c2a5-45f9-badb-7b6d72c7a5da", "value": "9A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115401, "uuid": "3ee9fda7-d952-4920-8aaa-c366ed6d8d66", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115401, "uuid": "5f8aa0a4-226a-42a4-bea8-b02a65f3f750", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115401, "uuid": "f880e13b-d769-48e1-903d-a336f5c0cccf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115401, "uuid": "822523d0-e781-4bd7-9299-f058adaad90c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115401, "uuid": "edbb06f5-10cc-4dda-a50b-59138f10d9f8", "value": "1a30f52e5168fba73171a72751b982b8b5254403ef258f2455600cc22a487d6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc48fa6-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143734, "uuid": "f2fa5b9d-4209-4fc8-9f37-c3ad3bc85706", "comment": "Malware payload", "value": "2e2ffd898117d3f23525668a6967ce6e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143734, "uuid": "0e7b7176-ab60-42d0-bf95-5e3a195dbbe3", "comment": "Malware payload", "value": "1a6944c1d669a831d6690295e7e6e5cbcfe9da5f4e1c6a67238d0af5040000ed", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143734, "uuid": "519b4180-f3cf-42b5-bb6e-c402547d1a3c", "comment": "Malware payload", "value": "4eaab9bc52b2dfe586d04a1719fef3e8e3f341b9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143734, "uuid": "910bde52-d1e3-4648-94df-f462e6c7762d", "comment": "Malware payload", "value": "a98edbe36e8556bd94ebd97214cdb3c76ee0d61280ca06f3987d157dc4dff79663782e402dc30499a69ef85dfbd08127", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143734, "uuid": "93cb51dd-b291-45cd-a022-1c6c13b83a3f", "value": "E814BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143734, "uuid": "5c5ff0eb-27b1-4fb8-aacb-91bc157a50c5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143734, "uuid": "0afe5089-49a1-4572-a9e4-8ac163844235", "value": "3072:H3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:fJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143734, "uuid": "62521977-7fcb-4f93-811a-b469bb0781a8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143734, "uuid": "dd18f00b-daf3-40a1-b02a-d750098d83bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143734, "uuid": "7c0ec0d4-2052-4b04-a162-4cf99ef93423", "value": "1a6944c1d669a831d6690295e7e6e5cbcfe9da5f4e1c6a67238d0af5040000ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1539cadc-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114460, "uuid": "bae8b76d-a47c-4670-a91f-2b39ea13837d", "comment": "Malware payload (Dridex)", "value": "5a51611cdb968eb64b1b0052602097e1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114460, "uuid": "168906ef-5013-4475-b285-1d6f38958e45", "comment": "Malware payload (Dridex)", "value": "1a6a9b51dcdfa8d2df245f40dbc8976b231e4af2950d7be68352bf19baed36e9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114460, "uuid": "a48a3cb4-80fd-499b-8b32-f4be6f8411f0", "comment": "Malware payload (Dridex)", "value": "d4814f6c5e664de75288ec538f9e4236fdd9f964", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114460, "uuid": "802039ad-85dd-4dc1-91e0-c0d55527badc", "comment": "Malware payload (Dridex)", "value": "87526f344a59394803eaaf3eebf3f611cf149341d4ab6447126acbc18fcdf5ba5919fbe61846fcf679663a1f0cc08da3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114460, "uuid": "cf08f799-c386-4020-9bcd-2c3fd16fb7c6", "value": "4114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114460, "uuid": "ba6bc66a-80d9-4227-b90e-298c97b38776", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114460, "uuid": "34890f7c-a1b6-4545-8d77-bd6df54f7313", "value": "3072:h3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:5Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114460, "uuid": "ed57ec05-41c9-400d-a30e-fd80a2c78e86", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114460, "uuid": "05558271-56b3-41d8-a20d-69a3052eb12b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114460, "uuid": "a8ff336f-d796-432d-adb5-cd069e6c2b38", "value": "1a6a9b51dcdfa8d2df245f40dbc8976b231e4af2950d7be68352bf19baed36e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31051a2f-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "feea0c2d-b85c-429d-9d59-6995b3db68bc", "comment": "Malware payload (Dridex)", "value": "58ac5cff3d2552a891e30a1b03824561", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "b549e0b4-8062-4384-b612-8c6a4ab3f85e", "comment": "Malware payload (Dridex)", "value": "1a7694c534e2a846e39656c4996afb676d8e066cf901ef74fbd4225e98f39ecb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "0bef6190-7582-45f0-96f1-22b4110a1a8e", "comment": "Malware payload (Dridex)", "value": "19595859fed85f95488cf186503892e9c6a555c2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "732c4c88-835e-41a3-833f-2aff4fa26e01", "comment": "Malware payload (Dridex)", "value": "f7c017a726482587cea3d59012dd72c9b22e2105132977b33db7bbafca6cef4577c7cd4cae2754c758557739cd821dcf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "e2c294af-0301-4257-92d6-23455d6a4411", "value": "0F14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "00b803e4-68cc-4868-8ba9-82457281d1a3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "0f712fcc-c553-4137-8659-ccad9529add5", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114077, "uuid": "a125d09f-090d-4889-aa57-4a4b79a18387", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114077, "uuid": "90c569ce-2894-4d0e-91d8-162b692eb9e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "625f213d-c396-480a-a1e4-bdcffbd6f17f", "value": "1a7694c534e2a846e39656c4996afb676d8e066cf901ef74fbd4225e98f39ecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8af3b0-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117933, "uuid": "17df943d-7ec9-4d51-b797-ec1a9394f801", "comment": "Malware payload (IcedID)", "value": "8b16c2d658f8328fc516e67913be309c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117933, "uuid": "6fe96860-8cb6-45f2-8b93-1b76afef119a", "comment": "Malware payload (IcedID)", "value": "1a9696d93efb419252893c999ae4d983cf0c95450442648fc269152e66696c05", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117933, "uuid": "f49ae40f-835f-4d87-bb43-29acbc1a11f4", "comment": "Malware payload (IcedID)", "value": "53b0ca7bc59c1b65515fbb9871ca6336a8c93cc1", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117933, "uuid": "d87a1d22-1445-4694-be67-145476e5c46d", "comment": "Malware payload (IcedID)", "value": "315a87ff9b4dd8183e347cfdc1e96f9fbc3542bfbd4f02d61d4f854fdf573ba381b56072c9a25b100650aa14feea1a3c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117933, "uuid": "520a8dd2-14a8-4c41-8601-cccd8448fb70", "value": "58B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117933, "uuid": "6e15d08e-bde3-418a-a460-9fc17fb1cee4", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117933, "uuid": "372b3a07-2d76-48f8-b662-6d60c97c00bb", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117933, "uuid": "818cc8cd-e34f-4564-bff9-ad0608328f15", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117933, "uuid": "9cf04737-0317-4e3c-8537-765ba6dc1440", "value": "document-1162006307.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef2730dc-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617106665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106665, "uuid": "19667898-7e52-43de-bb10-fb2902809838", "comment": "Malware payload", "value": "77bacce9986d82ee5af8e6656848da92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106665, "uuid": "1b5ccafb-a94c-4f01-a017-00e6c1f2e3a0", "comment": "Malware payload", "value": "1aba8cc2630000d1ae8693e33c9258a2407abfc44e363f9d0a5edde35c791ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106665, "uuid": "0db2f556-7202-4f9d-a5eb-7d315737e20e", "comment": "Malware payload", "value": "d81513f2445a0f64dbf3e8cd5632ce18cd0bdb92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106665, "uuid": "227f8aa8-ec22-4923-bc0a-2f0c41f0fa9c", "comment": "Malware payload", "value": "74f4b9669bfd50439b6eb70ae723a8bc4863708d3644695bcaa647b7f576f77f606ac0a48f1b9d1402b68d36ade16862", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106665, "uuid": "3c0f4b91-eab0-47f2-bb78-306321e8b394", "value": "A143C38571280D6DC202BAB24A8577E745FAA1D40AC59FC08ACE3D70BFFAD24735EE51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106665, "uuid": "b9aa7fd2-ad58-49a9-b27b-780696d93ff4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106665, "uuid": "b8363550-5284-48b3-85f8-8ad8315d7a1d", "value": "768:i90aGfJ0NMEdqcHS0Bq7eT00zKJ/D1S2KC3pUlocUEhS:i903J6dqcV00zKJ/D1mCZUlocU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106665, "uuid": "55cb7494-27d8-4cab-a4f4-e754b7095b0a", "value": 58120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106665, "uuid": "11082056-bf32-4ff8-a9f7-1be247fed0de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106665, "uuid": "44d3f395-f7a8-48dd-ae4d-c942feadb3f4", "value": "PO#4648 & PO#354648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda48ca9-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085590, "uuid": "8bf95c2d-ad1e-426d-83a6-df0188d202cf", "comment": "Malware payload (AgentTesla)", "value": "c777e10b85823e280255fd47281190ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085590, "uuid": "1264a08c-e43f-4e7a-94d3-6b86be77d1cd", "comment": "Malware payload (AgentTesla)", "value": "1aea4e7b8481bcdd7b508a00f90e0547c40aa2dfe47805c4f199b136cb31e12b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085590, "uuid": "febcdedb-8824-479f-bdeb-785b2ce3893c", "comment": "Malware payload (AgentTesla)", "value": "c9dfee18c0ce7f347d8ca34834ed2dc939c8605a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085590, "uuid": "e169de47-d367-4ac0-8339-4bf42336294d", "comment": "Malware payload (AgentTesla)", "value": "5733c32247d48b1cafd213397df61b957ba746af14b05933e1704f50106cd8c3e7a027b5ebda73a81c4ad78efb987eac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085590, "uuid": "5ca61923-9a2e-4677-8246-3c0d68b0d59a", "value": "2D33A7AB2255F5C7CA8A5532DB4FD8543D28E335EA81870BE052C26CEACB5777DC84C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085590, "uuid": "55025e8a-b73f-4084-8a99-bcfaa2fcf8b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085590, "uuid": "341cea5d-b72d-42a3-a814-61bed8268e23", "value": "384:lATThGlGvD0AQqtI2imKNOq2Hz6arZgS3LmOpOruBG4mJLfMurqCNwDJnF/5eeYF:lnGvD0AX9KpAVOJL0/ethn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085590, "uuid": "2f4707c6-52dd-4ddf-b589-50c0276ad6be", "value": 50200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085590, "uuid": "c8e2725e-2e94-49b7-b0c0-40aba3acd033", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085590, "uuid": "b408600e-4cf0-4953-89a8-19167051c172", "value": "DHL_document11022020680908911.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c6264e-9112-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617079405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079405, "uuid": "8c07cca7-bc6b-451b-8ebe-057e143d8dc3", "comment": "Malware payload (Gozi)", "value": "bf4c90ae0eb8ef0338e4dcc7167c6b84", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079405, "uuid": "34407e70-02e7-4c66-85e1-e622e4618e99", "comment": "Malware payload (Gozi)", "value": "1b5641736697ef32e2ccc354f081479520e870cb598eae14b6debb8554a38858", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079405, "uuid": "70f9ec32-9fda-46f6-804a-aebcaa5b2568", "comment": "Malware payload (Gozi)", "value": "cf6bffa7c35f6d7e3084211aeb137c24442581a0", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079405, "uuid": "b7dddf34-90ae-4a8d-be3d-bcad5dd7a6de", "comment": "Malware payload (Gozi)", "value": "2579c4724d46eea31fec2945a8794c13b4035d549a197ad869ccf1a67b86967a137033fafef0bee8347bca4b0b6c88a3", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079405, "uuid": "7c00ca76-e643-4ae2-a45f-b988dde7808f", "value": "2A9312B2141EDEE756FF1B71D67F2A2E1903E08D3B1201970A62EAFE2D15050085E7CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079405, "uuid": "15b7b623-6ebc-44f4-896d-1691e153613e", "value": "1536:QJcil7oYBwBFmU/iZ1WX7AEx2oWyr1mEW5lN68Md+CnaI4/W0bpx1rQsrmvo:jil8Uw7D6zod2oWyJ/iN681uj4/W0bpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617079405, "uuid": "55be4e3b-28b3-4f3b-99d1-74d3f5f351e3", "value": 95446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617079405, "uuid": "0508ee31-e990-4e5d-9038-249e3c297bcf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079405, "uuid": "c5a4e746-9dd2-4ddd-a244-417375e94f8d", "value": "impr_720.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47958870-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (STRRAT)", "timestamp": 1617106813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106813, "uuid": "ea2c9189-e5af-48c1-9f5a-182352b31861", "comment": "Malware payload (STRRAT)", "value": "545dbcf876b0cd881d21d8bfd4f75914", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106813, "uuid": "36e19ec5-3054-49ac-a7f9-1e1fa89c6928", "comment": "Malware payload (STRRAT)", "value": "1c2c1cddedb8bd327d2d796c7df3518de2b5b8865f83af6ec0264da622206cf3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106813, "uuid": "3e2f1cc6-09d1-473f-bed6-3411c2adf0e7", "comment": "Malware payload (STRRAT)", "value": "dcd45e02b8f6dc6ce650b96f47ca0de89ef5293b", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106813, "uuid": "8d32466d-6b08-41a4-a9f7-9167f34cde23", "comment": "Malware payload (STRRAT)", "value": "bc5cb5e5ed60d11f793fe63322c999aaa444d1a48fbbb541e387442ee795f46c23f9fc4bfcc53f9858dc5cad873fed4a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106813, "uuid": "1f7e2f56-b7ab-4893-8342-051370a2bdb2", "value": "FEA3DF0F3DA5DA78C1276CB249149A33A92D1298D02EA52FB2FC47090C75D9DDB52BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106813, "uuid": "89a6b013-9b9d-431f-8ff6-583036224ee2", "value": "1536:ywlPEiOpg23lMdvMp7CfPzVDLcUBnb6qTUGSTYwOYiZPyorppbCck:ywlPN03+RuGfrV8UBcGSTYwOYeyy2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106813, "uuid": "a6bd5fbf-8e68-424a-9d44-cda224cfc590", "value": 99370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106813, "uuid": "d475dba8-0e08-4ca6-83cd-a2b5c262b686", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106813, "uuid": "951ffe7a-368b-4388-b8f9-3b949119dc95", "value": "P421-0002-8879-RAV pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557063cf-910c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617076772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076772, "uuid": "4ba4d8e1-046d-46e4-a63a-9ec6e594f3a8", "comment": "Malware payload (Dridex)", "value": "5c9d639df2b50ceb026485e90a8b4891", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076772, "uuid": "ee1b6e95-3aa0-4677-893f-bb6b0bd48120", "comment": "Malware payload (Dridex)", "value": "1c51e5c0629501871d2675a5e19748242b63da4fed59e6a025d18db81a8d43f2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076772, "uuid": "c3b8eca9-4949-4f29-97cf-8269a4b9203e", "comment": "Malware payload (Dridex)", "value": "9cccae7c124cfe22818ea1b94405e0b27f57777d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617076772, "uuid": "b67c8af6-89cc-47e9-9ba1-b71dc14cfd23", "comment": "Malware payload (Dridex)", "value": "ef04382bb0de3b21554d658666451f2de2636a18f46f6b50c4ecb6d6204432f45688df811b547dec644217c3fc2c228b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076772, "uuid": "55776efe-8237-4fd8-928f-422fb7b86085", "value": "9014AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076772, "uuid": "a401ad6e-8dc4-453c-b193-2dd4b1845ddd", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076772, "uuid": "597a0c7c-b5e1-4a2e-825f-5f97f0f0b387", "value": "3072:N1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617076772, "uuid": "4093ce29-e22a-44e1-b2a9-168dbc368478", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617076772, "uuid": "3736cc4d-ad0a-45ac-9128-148fe37a6268", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617076772, "uuid": "addc1da3-c02c-4727-9e9d-b9f0c0a187c2", "value": "1c51e5c0629501871d2675a5e19748242b63da4fed59e6a025d18db81a8d43f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdfa6a4-90fa-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617069085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617069085, "uuid": "e9f67ba0-f507-4fa6-8b6b-d59536f6eccd", "comment": "Malware payload (RedLineStealer)", "value": "e7a524ad322494918ae561ac14d3445d", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617069085, "uuid": "b694894d-1b5f-4956-9a23-1850f210c518", "comment": "Malware payload (RedLineStealer)", "value": "1cb6f41ae09b700eb04f034abd2fb8c727383d671ba11f14309dd2b49d32d54c", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617069085, "uuid": "3e51916d-ccda-47d3-9b0d-143c68ac1f13", "comment": "Malware payload (RedLineStealer)", "value": "74ffc8f53828ac3c6bea58230922b929f9405990", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617069085, "uuid": "7c84203d-f40a-4b31-9210-a8f1f8bbfaa2", "comment": "Malware payload (RedLineStealer)", "value": "526bf83999229a75122875e2c1583b08374b702a0c7528d3ede211f499bcb9d2b42206112af0c17adce5d12d6ddfbd01", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617069085, "uuid": "14c74119-3535-4c3c-9bb4-b3d00fad2c8c", "value": "E995725D5E89D05DC13836F7818A6EF012967DE2A612D81E68F03EEAB43238FDD4215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617069085, "uuid": "4956a527-f2b4-4a76-83f7-3e4c14e5f1aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617069085, "uuid": "6ba2c388-f5b3-4242-9c4f-62a0e0b1c98d", "value": "49152:too1g0GIzSU2i152aiof/4mU2Y5d1grU/VXEOKNRalJ6Bn5H:too1g0GIzSU2i152aiof/4mU2Y5d1grj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617069085, "uuid": "e8b63172-06fb-4732-9d92-16e23f567f24", "value": 1922488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617069085, "uuid": "0c61d6b6-994b-48bc-ae05-c1724904015c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617069085, "uuid": "4b7ebc7f-714c-4be3-b1d8-162ea31a9dfb", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DCT.genEldorado.2563.29976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fa1c08-9187-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129598, "uuid": "c5239f2e-fe19-498c-852a-8a5bc69deea7", "comment": "Malware payload", "value": "4b81f243382d5f3a9c9c37a3e61fcf98", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129598, "uuid": "eb6f7542-40c2-40f9-a9c2-728b65b48ae1", "comment": "Malware payload", "value": "1cc28c7be808a96f6a02eb967aaebc06d9cd50982447575fcd403f6843b36a7d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129598, "uuid": "0bd66b06-e8c5-4dc7-a968-88c1d9f27aac", "comment": "Malware payload", "value": "e68a7b184d482ef9e91f5510ffcdc50c95ea10c9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129598, "uuid": "f43702b4-74c3-4500-9c5c-e79ad4057f73", "comment": "Malware payload", "value": "e67ae471f3749bf89eef63abcb7f35073ef8c64c238ec454940634eeebd911ba5950fbc02d6488ab82e7ec35c518744b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129598, "uuid": "27f8eba2-b5e3-473c-a157-48a9615aae62", "value": "4714BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129598, "uuid": "b2ef8669-c0d0-4791-9019-9b843407a4e2", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129598, "uuid": "1c80118f-6bb0-4803-9fb0-b9a56d15b202", "value": "3072:O3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:qJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129598, "uuid": "03338fa0-2a1c-4f00-bd74-de8498664126", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129598, "uuid": "d1348a21-7c15-437e-9a83-d72417da4e6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129598, "uuid": "094fc980-7809-416b-87a9-1cc15ba2a4cd", "value": "1cc28c7be808a96f6a02eb967aaebc06d9cd50982447575fcd403f6843b36a7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3494908b-917d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125250, "uuid": "7a2a8ca0-198a-476c-815c-b24a676cf716", "comment": "Malware payload (IcedID)", "value": "1bd788601298b16000978d11ffd13152", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125250, "uuid": "ae1d4dc0-d90f-4511-84b6-9a04a048a936", "comment": "Malware payload (IcedID)", "value": "1d992ca8501ca40b8ce9f30f84b426c0b208fcb76373b981a0be20c8abc04741", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125250, "uuid": "47f2731a-d3b6-43cf-8467-573ae5d03be5", "comment": "Malware payload (IcedID)", "value": "4fa38ceef60950627bacdb8d3258fce60ef4f947", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125250, "uuid": "4af988d6-1b8c-4305-9715-bed8ceb94980", "comment": "Malware payload (IcedID)", "value": "0e16b9f9ceeb55ba636947af729c05ff8c5c35aa97d498d4ce3987b91232552840bef8af8ba79f6458f68de69670d5ad", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125250, "uuid": "619278ed-c458-457e-807b-54122d1547cc", "value": "6DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125250, "uuid": "54ab12e6-7cf4-4e51-8d77-a352b6799cd3", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125250, "uuid": "7336cb18-11b6-4488-9d3c-b44708597539", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125250, "uuid": "cb19b403-4795-452c-8add-3c5004783600", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125250, "uuid": "20773b94-01b9-4180-8a87-46b61515b647", "value": "document-227171473.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384a6441-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114089, "uuid": "a8a73df1-94fb-4850-b1ee-7d6114b60ca7", "comment": "Malware payload (Dridex)", "value": "de51b753304ae6e85a731a09f5b47489", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114089, "uuid": "8baf758e-699a-4968-b3ae-2afb6a79a942", "comment": "Malware payload (Dridex)", "value": "1db08704a3e1690a4b17fbe1481531d02b015559d1c969f3e06fc576ce4d5612", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114089, "uuid": "e5a1ee1b-a6cd-4ff0-a096-290d9c5fc0c5", "comment": "Malware payload (Dridex)", "value": "08943f7cc11be0f1f4eaa2ea37182bf6eda42078", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114089, "uuid": "59f402f6-785e-421d-885d-c2d1158243fa", "comment": "Malware payload (Dridex)", "value": "59eb36877bde64eea8d09e3bf456d613655ba8601f687a209edb388af87ba3615886f8e2322b2b5ee7b2f2d6112afb6c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114089, "uuid": "b9c54e55-6585-4501-a5e3-e2880559bc0e", "value": "7814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114089, "uuid": "09f4f448-dc17-4043-9efb-236b18d99c70", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114089, "uuid": "2673fcd1-120d-4386-9b96-d70cec00e50a", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114089, "uuid": "340c72e7-31b4-42fb-8db7-889424f0d0b6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114089, "uuid": "45f43281-53aa-4fc4-ad76-78901a8ea116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114089, "uuid": "b58f3625-0974-4e7c-abdb-9bc1a174b129", "value": "1db08704a3e1690a4b17fbe1481531d02b015559d1c969f3e06fc576ce4d5612", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff529f4-9167-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115793, "uuid": "804e98f1-11bd-4867-b5df-0be3157004e1", "comment": "Malware payload (Dridex)", "value": "357255e28a881b7dcdb5f7f13c1c7a47", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115793, "uuid": "8674397b-1315-4648-a9d5-421a902dbecd", "comment": "Malware payload (Dridex)", "value": "1dd2b9e68ae07b80fe168ec0ad53ffb10a01cff582a28dcfca518b1ef205ddbd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115793, "uuid": "9e81360d-e45c-4271-bb16-70e9c6eb3703", "comment": "Malware payload (Dridex)", "value": "7176dc4c837c35f81b337665d227f4671c200207", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115793, "uuid": "a5f3a84a-2963-4939-93c2-3c456e5d1b10", "comment": "Malware payload (Dridex)", "value": "3e5a80f80782f3247fa05e97e5224265444ee2c74a3d352cb2b8fd358ceeb17fb683ee5b63099ab730f18648fbc6aa38", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115793, "uuid": "286c9133-fd9e-4656-b244-0c96601bafd0", "value": "4614BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115793, "uuid": "36aee9bd-3e41-4788-b992-41b7d28db09f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115793, "uuid": "3c57136d-8872-462b-90c6-bce3c557b722", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115793, "uuid": "63163133-7524-44bb-aad6-d1b4b13392ec", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115793, "uuid": "47431904-c974-4fbc-abdb-0050246c10fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115793, "uuid": "12a0f8f0-f02e-467d-ae16-f6b8e8b21b98", "value": "1dd2b9e68ae07b80fe168ec0ad53ffb10a01cff582a28dcfca518b1ef205ddbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90603904-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617108654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108654, "uuid": "d345413e-d51d-493a-a693-4af54ab10b4e", "comment": "Malware payload (RemcosRAT)", "value": "dc736e5e09d43f1c9a3a23f6cff45401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108654, "uuid": "af3f250f-e9df-45d0-9003-47ae807fcd61", "comment": "Malware payload (RemcosRAT)", "value": "1deade2c1ec1622757e44e7a246cc0b0db62b88cded9cccfc418e1bca6b95b39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108654, "uuid": "075a8429-1218-4795-8f72-c379033eb900", "comment": "Malware payload (RemcosRAT)", "value": "edb5f73848b40bbedc5f983818a55b697aa8438a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108654, "uuid": "92855d1e-b121-404a-b8d3-73d5165d7169", "comment": "Malware payload (RemcosRAT)", "value": "a7389f34234c709320520481217d0d3bf2fa285376e208e51f37163e5a3024a5745346dd6be3a2a6d91c6e330d24ea52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108654, "uuid": "86cd454f-51a4-4af6-9baf-1bd4a8a9b8dc", "value": "52D49D22E2D04837C1231A796C6BB7F46935FF212AA8984667F82F4C5F353503E295A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108654, "uuid": "9b5529eb-8a11-4140-bf51-9e0b4118b2fa", "value": "1348df303efcafad50a6f5b8c3aa3e4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108654, "uuid": "00a31b05-b0fb-4fed-b82c-8186f891e894", "value": "12288:bsO+MZAkQfZuFvTdtchSOgA9PBbg5pg+s9GgVe7Y8:QRMdQfZuVTdafDZ+ODf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108654, "uuid": "f20c3d4a-bfb8-405a-a328-15c407f9a92b", "value": 632306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108654, "uuid": "1acdee2e-7250-4540-a518-dbe4e90b6731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108654, "uuid": "e7c41d77-a719-45ab-83e5-8340a5ffbfcf", "value": "dc736e5e09d43f1c9a3a23f6cff45401.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc6bca0-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115333, "uuid": "552fa31a-26a3-44a0-9217-f3870edd444f", "comment": "Malware payload (Dridex)", "value": "03e77bc51a270abdcc3fbd5df8add344", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115333, "uuid": "94f05d2f-6c6d-45ea-9d6e-1e00393a1dec", "comment": "Malware payload (Dridex)", "value": "1e3dba1db0eff8a7a2ff910739f36b36f94a80e2a54af3a55c6520acaea979c9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115333, "uuid": "2f4d1f24-ed82-4845-81b9-db1474ea18ac", "comment": "Malware payload (Dridex)", "value": "af96baf75ea7a7c590fd0779c6a75c2aa093e6c5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115333, "uuid": "5ea58814-5a61-474d-8800-acac75bb7af6", "comment": "Malware payload (Dridex)", "value": "abcd2d89650148832625e6249d4b11b5ef70589d7ca5cb20363c233a6189350c847aeb1b52a6acc56738da399afe1bd8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115333, "uuid": "c0853b1f-2c6f-4067-82c7-e07d8dcda6c4", "value": "2814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115333, "uuid": "f5b4dc87-e8aa-4fe2-9c9c-180930953061", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115333, "uuid": "889cbe72-5dfb-4291-bf37-2da6fa7dfd10", "value": "3072:A3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:EJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115333, "uuid": "9e700bac-8fc5-4d89-94d8-a1b215e135f9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115333, "uuid": "efe45781-f5d5-4403-a246-321aa6f7c97d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115333, "uuid": "a93985f8-67d3-463f-a597-575033689967", "value": "1e3dba1db0eff8a7a2ff910739f36b36f94a80e2a54af3a55c6520acaea979c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b34069-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108495, "uuid": "92e1f982-67a9-482b-a70b-29c0496cf7d1", "comment": "Malware payload (Quakbot)", "value": "ad876de8e881e5230af0aa0d6047ae18", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108495, "uuid": "a8949f50-c1f0-4ce6-bd05-cdffa21216f4", "comment": "Malware payload (Quakbot)", "value": "1e494dab0d671280c4322fa47130e4805d0b456759f83dd83ac62d82ae8a2766", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108495, "uuid": "ab4a9e8a-42a7-4ece-a634-6bfa290c0518", "comment": "Malware payload (Quakbot)", "value": "3b871930c51ef069bc7044c8cd1c33121eb98e3c", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108495, "uuid": "3d62774b-4778-48cb-9ba1-96397633d6bd", "comment": "Malware payload (Quakbot)", "value": "8a60efd3d33982d460a03a0afbde7a816e7ec25fbcc0c7c91c7828e7d4b7a70ae2992bb683237a102ab9455cf17cd027", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108495, "uuid": "6d4378ed-d0f2-4a75-b2d0-0940314e5f54", "value": "25C3CF5E6244742EC39FB53D9A06A8E30C860041E997F53F32B0AF0D65AA2C71F9E59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108495, "uuid": "2976b7be-08da-4839-896d-fa7a33967e43", "value": "1536:RT6O5/eJCDK2vOpxOWzbaetTv7xVMsigZEQNggMorCKYg3wlNT9U+89GIbGqXhVs:96JL2eXKeTdV/vEQSlcCoEi9TRf65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108495, "uuid": "d08b376c-0521-4369-b233-aa3a19310db8", "value": 121096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108495, "uuid": "775b6e8a-f0fb-44b9-986c-69ca4104ce9f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108495, "uuid": "9815e096-73f6-4b7f-b9c7-f6a830ff6ef3", "value": "fisc_2146.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63f49ca-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120716, "uuid": "2dc38308-cafc-4a7f-94d3-d786ede40af7", "comment": "Malware payload (IcedID)", "value": "bf180604db0affd8f1cf95fd93674662", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120716, "uuid": "f1f4cf4a-1962-4b1d-a041-63cd2a7a751e", "comment": "Malware payload (IcedID)", "value": "1e65e825e362f5dc7bf27fb2faab13853365b4c46f199cbe6ec0024743746b0a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120716, "uuid": "e0fac258-8ffa-4a3c-a246-af435d76e2eb", "comment": "Malware payload (IcedID)", "value": "68d7164ab42fb7500c3bd131753f5b8b3afd95e2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120716, "uuid": "4d3839b7-70ba-4ed2-82ed-ae09457ae7ad", "comment": "Malware payload (IcedID)", "value": "38a4ada17d1268ea67287e20ce104e0037a57fac0777ebb08c35c12fa2c43181b535f8d76e7a3a16e45278763319edc2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120716, "uuid": "97677997-4908-45f7-9b80-2ebb280fce07", "value": "01B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120716, "uuid": "6adeba13-a817-45a8-a2e6-02e0f8c93b2d", "value": "3072:c2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:czxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120716, "uuid": "c14340c6-758e-45e8-a9c4-b7c17ea9cefa", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120716, "uuid": "1fc4000b-f6a7-49c7-afb9-63f19454b86f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120716, "uuid": "07212b62-7892-4688-9a57-5b9714d98758", "value": "document-140813832.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fefddf-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122786, "uuid": "edf3c92b-480a-4eca-ae15-85103ecc4e93", "comment": "Malware payload (IcedID)", "value": "343463ac6584d3a2c922b2007997e99e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122786, "uuid": "050428b6-70a5-4d90-a1e6-fa3c6508f2eb", "comment": "Malware payload (IcedID)", "value": "1e846c640f8f6567470db44e41a50fefb342e5538c5f971ffb5c74ed9cb04a73", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122786, "uuid": "979d42bc-1199-4e1b-8e26-be6074dbbb42", "comment": "Malware payload (IcedID)", "value": "45c8a2481304cb669313fa2f6f54760e2d6269a2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122786, "uuid": "01e56ae7-4888-4331-bbce-e833b6056f6d", "comment": "Malware payload (IcedID)", "value": "a8b4d8414279d2bba3fd5140d6c3f21c59d87c850f90b3e277fa0c1452c32b62bc55045191ca2b98aefd7e26b741b1b6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122786, "uuid": "f5d5fb0e-9f76-4ee4-a1b1-77bf71f40ce9", "value": "D6B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122786, "uuid": "11a1b73c-103b-48a5-8e59-f08a3db535ee", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122786, "uuid": "e6f427cc-1b43-4fd6-9cc6-d584a049464e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122786, "uuid": "ffe55acd-1c86-4940-8c2f-3970d9e5049c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122786, "uuid": "e4727486-d6af-42c6-990e-2844ad253b1c", "value": "document-951401686.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0983ad48-9149-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617102844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102844, "uuid": "ac441b2e-c941-4c56-a7f8-8ce05abef64d", "comment": "Malware payload", "value": "0586f37d8301f461668b1653f83a1e75", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102844, "uuid": "ca71f6c2-bb80-40f2-96b7-22596b7acb72", "comment": "Malware payload", "value": "1ecbacd7806afde20aad936b6f37a2b086c91cfc60b5d0b70f011398774eb7ac", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102844, "uuid": "8d8b5008-91f6-4d75-aa15-d4c8251c451a", "comment": "Malware payload", "value": "10d0279115e2bfefaf31094b5241d89a964443b9", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102844, "uuid": "b136f5d9-5f39-442c-996b-16330af14d97", "comment": "Malware payload", "value": "5883336fb0ef294018e4aa9745c74917121458543accf62288ede74896df91d597ff6a2f8f30bd461b2129c677d58a42", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102844, "uuid": "e94127c8-6541-4637-b765-b910d9f284e0", "value": "22226D69C542FC3BC213493EE05805F5EB0C1196E693A87B615DB19E47A02938B9F2BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102844, "uuid": "847ddc73-acf8-4efe-999e-c37a65d4a8f6", "value": "192:ycIMmtPCmHqqG/bYxuXgkD6/JgiuQ3TdZ5t:yPXqmsr5D8J79TH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102844, "uuid": "8be8bc99-21b1-47c3-95fe-ff6ee53eeadb", "value": 10326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102844, "uuid": "09a866b5-786d-41a7-917c-a8911c8c5576", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102844, "uuid": "2199ca7d-6449-4fe1-9fc9-4f5a165027d3", "value": "WIRE TRANSFER.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df80e0a4-91a7-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143576, "uuid": "ff10443b-f26c-4204-8143-5e0472ce8b75", "comment": "Malware payload", "value": "7d86e250b874ed6497ec74d41bce3a8a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143576, "uuid": "f7053df0-349b-401c-a635-abb86dd6221e", "comment": "Malware payload", "value": "1ed4b30ed81ad68e4224056649f2596e5fe28af408f09fda96db3847794af8d7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143576, "uuid": "89714a21-1806-4b4c-a6da-a501122f9b34", "comment": "Malware payload", "value": "763bd9db94325456e3a5143c048c99a5460688c6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143576, "uuid": "4e161fa9-9593-450f-9602-7a6e6ba3cc92", "comment": "Malware payload", "value": "c68d2fc836dc2485e451ded4ed6ea28e9587e7c15dc467472ade22d4a4b7e0144b05a7948f815d4bba2edd30fb3de1e0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143576, "uuid": "6de58a65-6080-4297-816a-43cdf661dfdb", "value": "1514BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143576, "uuid": "f7ba2f29-b8d2-42e4-a522-3dfdc37cc37f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143576, "uuid": "9cf06fe7-49af-4251-9ad1-dda0898f6388", "value": "3072:O3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:qJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143576, "uuid": "8812179c-e384-4f4c-85a9-411c0f267354", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143576, "uuid": "5de0f688-6fd8-4c67-8dd3-56ae0d2dd050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143576, "uuid": "2d3f9eee-c614-4708-a90b-a342c26178ff", "value": "1ed4b30ed81ad68e4224056649f2596e5fe28af408f09fda96db3847794af8d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a791bc-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121277, "uuid": "4f16c15a-bf8b-483c-a2ac-212aec8e7803", "comment": "Malware payload (IcedID)", "value": "367d128c27636d41c275d6ccf8c8afca", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121277, "uuid": "b6ff0843-ec19-4b15-a68f-b474b41dbedb", "comment": "Malware payload (IcedID)", "value": "1fd0c5623c9267c735b7620855950726bbc43214b7eed6d82e2131b2b4281595", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121277, "uuid": "f498a77b-f311-4bed-a50b-41b4eb4c9b9a", "comment": "Malware payload (IcedID)", "value": "31ecb21d1119a466478c9977acbb9dab492d98c6", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121277, "uuid": "442916c2-3d6f-45ac-9d8e-2fcb5fc5b061", "comment": "Malware payload (IcedID)", "value": "9d49e7b473f6f655c1a23e767829c4a5f3aca101cf1427094aa6cc7c56f67f45716f8cdeaa204de073bdda9cd8105b41", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121277, "uuid": "e82878d7-0090-41af-92f8-126cb62d3266", "value": "44B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121277, "uuid": "7761af7f-93d1-4ac1-b70d-466fd1cc60da", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121277, "uuid": "b259336d-2568-49f6-bb32-7439d6f06ffe", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121277, "uuid": "74ea454a-cb73-4e80-b24b-8764d769e324", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121277, "uuid": "4bf6434e-ee62-4352-843f-b4c6b5704b42", "value": "document-494704155.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f814ad52-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121283, "uuid": "a1969956-c398-46ca-b2ff-da4e0ff2013b", "comment": "Malware payload (IcedID)", "value": "590c675dec17e0a7baaed817623f3e47", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121283, "uuid": "0b4673fc-f4e1-4b64-8f36-1784a1c77b98", "comment": "Malware payload (IcedID)", "value": "1fff304aaf2ae1e01582e86537b7a590cfc0965165cd1452b9932291bfcb0922", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121283, "uuid": "f13a7e19-8fb6-4920-b3ac-2f340662600d", "comment": "Malware payload (IcedID)", "value": "6f82842c7216b0375598811ec8aeb183f8dee58f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121283, "uuid": "77a69346-59d3-4e0f-a876-e1065dc2c5c5", "comment": "Malware payload (IcedID)", "value": "32fd4f8b45b71203ab2cd24c52d0d668e3e775dfc6f71948ac2897fdb4f345cb4539e266b67f265de6f75ec320ea03b7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121283, "uuid": "feee1416-2c9b-4dcd-9b26-aa1277fb35eb", "value": "0FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121283, "uuid": "d316847c-673e-4cd7-9891-6ce15e2fce01", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121283, "uuid": "a2c5d82c-fdf3-4c27-a807-57b947976392", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121283, "uuid": "7db0b45c-c920-4aaa-85f7-9190681b482f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121283, "uuid": "b0702a4e-e12d-428a-9693-b9aff3a13b8c", "value": "document-1049620718.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7681d3-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126253, "uuid": "224a2f90-f8ad-4a97-8275-113a5c24aaea", "comment": "Malware payload (IcedID)", "value": "82040b0565d420668ff0babddb7b8c39", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126253, "uuid": "cbe8f496-4c55-4399-a760-792aa05aa741", "comment": "Malware payload (IcedID)", "value": "20323266aee7b3b4e84a692090ead4615148f0496239cd594eda6b1fe9d01129", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126253, "uuid": "fb299c81-74fd-4bff-b773-3e005c172e62", "comment": "Malware payload (IcedID)", "value": "5bdd55bbbdebc2eec0fae600fd8fb62071eeba59", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126253, "uuid": "ccb9e869-c653-4f32-978c-a17fbb261b99", "comment": "Malware payload (IcedID)", "value": "9d17e3bf6996d9b11ffe8f8be11e2c924841844fdd8b1b6069e45bdd19ef12b68b48ca970a109ac44bfd204b9a1c7b95", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126253, "uuid": "3c16c04d-0b1d-493b-9569-04f9a1c47643", "value": "35B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126253, "uuid": "5609caaf-1e96-4611-a0cd-bbc8cf7b3e0c", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126253, "uuid": "6c7983d2-037a-445c-b68c-3cf6877a373f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126253, "uuid": "b8b2ff2e-2dae-4b55-a92f-00685b8f3231", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126253, "uuid": "09e25276-88d1-49c2-9b79-22c65cab095e", "value": "document-1264182345.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ccf2ec-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "fefcb44e-03c9-48f4-b4e0-9d329034e239", "comment": "Malware payload (Dridex)", "value": "1d926cb995c39d41ee7d8b27850a3ad5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "301f96b4-2223-43e5-8ddd-a274aef0c6a1", "comment": "Malware payload (Dridex)", "value": "2046b640d2744f02336f85d35be58dd7391189b45bd159b3f3508bfbc0818328", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "4abeed52-be53-47ac-8d75-988d94743f7d", "comment": "Malware payload (Dridex)", "value": "09ffdf826378b0401466f87e90a7243837bbd4db", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114112, "uuid": "39cb47d3-3fbb-4cbc-855b-dd7ebf8599ab", "comment": "Malware payload (Dridex)", "value": "4c5ce2828e13045d16430ab9e89c8295748b75d5019cdddda8752514464e257322045edc75df1300ccfe9ea6877e67d8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "da57f46e-171f-420b-af68-77e0accf2eb7", "value": "0914BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "fbf24028-e738-42dd-9853-a4c3e5cd5f9c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "8c2a6fe4-1bee-4373-8099-02ea7ac4ad30", "value": "3072:o3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:MJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114112, "uuid": "575d515c-f40f-4da5-802b-ef57ca1da3a1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114112, "uuid": "2a6404df-923b-475a-8e25-7a70e6c302c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114112, "uuid": "281983ed-aef7-4c1b-a30f-67062f0055f3", "value": "2046b640d2744f02336f85d35be58dd7391189b45bd159b3f3508bfbc0818328", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13db6aa-918e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132734, "uuid": "e4203486-e11d-4605-8139-6c0d2e005f41", "comment": "Malware payload", "value": "f50e9753bcf2332e9fc96790dc7df626", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132734, "uuid": "1fc084ec-5bfe-43af-9734-7d823b3cdb22", "comment": "Malware payload", "value": "20b52593e9d5eefc77a3a05d94360e1e0f1d398592853bfc3237b3cb5ac16b03", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132734, "uuid": "5fa658f9-8fa5-4f74-8ec0-b084e9b9af2a", "comment": "Malware payload", "value": "758bdd0240aea01fa1a152abca3b0fa1eaaac0cd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132734, "uuid": "36342f2f-8e45-4351-9b4d-187f398a80d4", "comment": "Malware payload", "value": "a1a231816dd15e9663b7fd58585a3f80a2d2e7c06f1a4a831e84209f40ed9f1a5a0fd2175dd8790c6e694713edf4f6e2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132734, "uuid": "b88cc188-116a-4a95-8412-0162a1a4a135", "value": "5614BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132734, "uuid": "1e4fe3e4-30b9-4af1-a355-1237501140d1", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132734, "uuid": "9800b130-924d-410a-a66a-800001b804c3", "value": "3072:/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132734, "uuid": "b6693607-5b0b-4a63-be3e-852e8ceaed37", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132734, "uuid": "2493cdb0-60d8-47ca-8ef8-f4a784fc2a32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132734, "uuid": "39bbe03c-eadd-441a-b0ee-6552196a6486", "value": "20b52593e9d5eefc77a3a05d94360e1e0f1d398592853bfc3237b3cb5ac16b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1cd16d-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108752, "uuid": "e2983e92-32b7-42a8-a6e9-daf4c3dba804", "comment": "Malware payload (Quakbot)", "value": "bb56628bec5054e9b0dc1a55e2572a63", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108752, "uuid": "ff52ba11-8fd5-4401-9016-d7eae43a6208", "comment": "Malware payload (Quakbot)", "value": "20c521bf077af288d4124e3f3bb61982591070422e5747a0787cef82083ddb6a", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108752, "uuid": "314b561a-a2ad-422d-ae64-cab2cae1693e", "comment": "Malware payload (Quakbot)", "value": "892109acb002cd2f95cf3f5c6d603207464e7539", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108752, "uuid": "252fbfcd-90ce-4ca4-8758-44968db79f34", "comment": "Malware payload (Quakbot)", "value": "1688d84f1663a334132ef0eca72c469f95744b50b2c016c42a01b1d872a7f517ff44e188157c59fab6592a3506996930", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108752, "uuid": "3e7fecee-90e0-4b89-92c3-df343f26fe6a", "value": "5FB3D08D7284B50FC3CFB53D9A42A4EB4C621095E967B13F3AB4BE0991E91830F5E59C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108752, "uuid": "1fbcb0da-0ccf-40e4-8be4-eba63946a3a5", "value": "1536:+NAhdus94uIJ9ICTv7xVMsigZEQNggMorCKR5wnz9WbX+qIyHvNY:6idus94OCTdV/vEQSlcCq5wnzIXrIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108752, "uuid": "beb7ec09-0954-4de3-ab6c-be956f24eae6", "value": 113453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108752, "uuid": "83076871-a552-4392-b465-a9ae23dd32c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108752, "uuid": "f22fcd88-e770-47ce-8026-31355f8147c5", "value": "lista_269.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18594e42-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120478, "uuid": "a7397717-f9b5-4a71-ad04-57e9b050f662", "comment": "Malware payload (Dridex)", "value": "8eea0674d693c16b551d8cbad55068f8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120478, "uuid": "fb141c06-fc59-43de-8331-f781d9d36f8b", "comment": "Malware payload (Dridex)", "value": "20d86f55fa926792d10af86f11264392970361532974e1ac82e57d78cea083d7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120478, "uuid": "33e5d6d5-d3d0-423d-974b-86a2e3022073", "comment": "Malware payload (Dridex)", "value": "8250d8e4d917c6f209b923cd4fd6b24d210e2b91", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120478, "uuid": "4efc2ef3-46b1-4c6d-a72e-fe01f339e66d", "comment": "Malware payload (Dridex)", "value": "7bf7243093c9ac47fa7e57d043a4706725196d2a321b3314c9283d2ff15a7a0888f447cd6bbfe69d167f94b71b2e4a93", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120478, "uuid": "48ad7b5c-45f1-48a2-8230-64190450c214", "value": "3214BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120478, "uuid": "bd1ad8e3-76e8-449e-92a0-c398564d2fbb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120478, "uuid": "1c3f71f9-8daa-4d0d-a3ce-8cb76de45e5d", "value": "3072:l3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:lJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120478, "uuid": "52e91a74-dbeb-49bc-b614-09a98db38106", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120478, "uuid": "2d2d6f1d-f09f-4368-8f25-26a6b88a98e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120478, "uuid": "f9c16904-5c0f-40a7-841f-ce869f6bcc2f", "value": "20d86f55fa926792d10af86f11264392970361532974e1ac82e57d78cea083d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0e8116-91a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617141370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141370, "uuid": "b4d3e9cd-f2e6-4c64-a624-f87d7c2c8146", "comment": "Malware payload", "value": "f6282c938e0662cf851feee0146d79a4", "object_relation": "md5", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141370, "uuid": "ee1e9154-f6fc-4ebf-b096-28ebd0ef6956", "comment": "Malware payload", "value": "2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf", "object_relation": "sha256", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141370, "uuid": "d51df28a-d1bb-4cbe-bb8a-9bd4002d395a", "comment": "Malware payload", "value": "9d0c6528565303e5b10a964a2783c77f25b9695b", "object_relation": "sha1", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141370, "uuid": "eae1c228-b1a8-4be0-a77e-bd56fe27982c", "comment": "Malware payload", "value": "0cf9693762d9c2e62967c34f3b86a9b6de5076a82a2e8918c3b658f0f847349f855dd8f905134f35bf10f39db555d776", "object_relation": "sha3-384", "Tag": [ { "name": "Babuk", "colour": "#BCB907", "exportable": true, "hide_tag": false }, { "name": "babyk", "colour": "#43308B", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141370, "uuid": "533e7aba-9ae2-418d-938a-d1b3d6c5c718", "value": "6C83E8115D45D2B6C5D1623191A7F1AAC13A197003B5B38B63C027AEFB10AE8F6BCF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141370, "uuid": "2f9de45a-693f-4ade-be4e-abd494c557fc", "value": "202fa14f574c71c2f95878e40a79322d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141370, "uuid": "0f5b178a-64a2-4499-ae9e-043cdc073c35", "value": "1536:Iiyy6UhZM4hubesrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2zs4:IiyshZ5YesrQLOJgY8Zp8LHD4XWaNH7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617141370, "uuid": "33716f58-b4e3-4b6c-b6ac-7108f42738e3", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617141370, "uuid": "883c87cc-9ae2-4eb4-9318-607b40fbb3a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141370, "uuid": "cffcb9a3-d702-4e61-b448-9803185fb191", "value": "2138c8a34a1eff40ba3fc81b6e3b7564c6b695b140e82f3fcf23b2ec2bf291cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0303221b-9157-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108846, "uuid": "f3f42a0a-e831-4c8f-9ed1-eaff2e0fce8f", "comment": "Malware payload (Quakbot)", "value": "61876c9fc98222705b017f94e6cef9d2", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108846, "uuid": "ddae7217-447f-4e6d-8895-84bd28547467", "comment": "Malware payload (Quakbot)", "value": "22b0db85fd48b04fcb5617cc13654e0c4eb27fcd8ba04ee1c5e054cde3bdbe97", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108846, "uuid": "63cc3261-f963-4eee-a496-7bc3bc8b2d60", "comment": "Malware payload (Quakbot)", "value": "1a8d1c11a1705efc34a9540320dbb3d0d543a18e", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108846, "uuid": "dd59315a-d567-4ed0-ac84-a484aa63d8f1", "comment": "Malware payload (Quakbot)", "value": "c9b87122139cef345f31531b51c53a7c1a802a6d5a63ac5198f690a5f7159653cd9f6bfeb8d1dbfd67a8c36fc1edf306", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108846, "uuid": "97f49ebc-80cc-4f47-92d1-052322d9d760", "value": "1EB3E14D6284798FD38FBA3F5A42B8DB1DA74040D626643F36B47A0D50FA2570F4E1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108846, "uuid": "5cbbc913-ce46-4d2c-aed2-605ed17baf18", "value": "1536:rU843g/nA7cKa3Tv7xVMsigZEQNggMorCK2A1w/+VAOucniGlvY3D5L/JVpPS:rU843g/lTdV/vEQSlcCi11eGFYz5vpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108846, "uuid": "c1738f12-6eb5-4673-9d67-f63913df5540", "value": 112402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108846, "uuid": "cc67fedb-c5f7-4334-a56e-12f6949faa56", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108846, "uuid": "5016494d-38fd-4cfd-ac16-232d1d78690e", "value": "operazione_2119.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3b5d03-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (AsyncRAT)", "timestamp": 1617108647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108647, "uuid": "958fe1d6-85e4-4ba4-8c4a-fc35163d43d4", "comment": "Malware payload (AsyncRAT)", "value": "077acaba7ab3d2fd714034725a01aad8", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108647, "uuid": "fdff76cb-ca63-4668-8c37-0bd2976a6995", "comment": "Malware payload (AsyncRAT)", "value": "22e55a154209025c55a6a4683572f1e90808bf49ba5c22ba96d32aabb6ac3e7d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108647, "uuid": "eb39b6e2-861d-4762-a690-8b2e7f77b615", "comment": "Malware payload (AsyncRAT)", "value": "db00a0ac662d0e51b5d6cd6a501d05d2bd88e53d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108647, "uuid": "857160fc-ee04-44d6-8024-ce52fe510eb3", "comment": "Malware payload (AsyncRAT)", "value": "60ead0f4908cbaf7895d815d33afe85e82b93b967a7418ae61cbce19f524323b061c752347f93617068391416efdbb08", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108647, "uuid": "a9ebbecc-df12-4fd3-be07-a3cc19a02361", "value": "4ED4F1A13698DBC5E63C17FB4525240047B9F7EA2023DB4C8D99F4EE296AF8D0DC0697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108647, "uuid": "e92c50bd-7066-4387-b95b-91d9dccbe726", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108647, "uuid": "9e9f5cb9-96d0-4b82-932f-903f086126be", "value": "12288:+WKQ+m/5AWKLrL2uSeewwrXf5tl03WhSOTracDYFSGpFE:X5LK4eeXLgWgOqcDYFSGpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108647, "uuid": "b25e7035-5755-4e9f-a52a-881c6b07f5fe", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108647, "uuid": "066948dc-f975-4797-845e-79c5e0ec077a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108647, "uuid": "b050e3a1-36c7-41f8-9c56-ad2e7df024b0", "value": "077acaba7ab3d2fd714034725a01aad8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34a8326-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120389, "uuid": "91206a95-c633-4bca-b4b9-bd780391882d", "comment": "Malware payload (IcedID)", "value": "8918ba9c0fe2f53c23b4c9c8e684c899", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120389, "uuid": "86490d67-28c5-447e-9e0b-bd6c02cd4112", "comment": "Malware payload (IcedID)", "value": "232000d47fdcf3aa3b65d1aaba83d4a7df47deda68a919205d475dd59f9df2d7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120389, "uuid": "91a285a1-379a-46bd-9915-6d65d8bcfb81", "comment": "Malware payload (IcedID)", "value": "c6a0e1a936c9f0946ce5e0b1fd28bd47a281a81f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120389, "uuid": "dfff9efc-103f-47d3-a80e-23b79e61c054", "comment": "Malware payload (IcedID)", "value": "cf0c6c044177d7305c5a44206f57c4933bb7df41686afe9f1ec96eada3ced7a201a4237632e1bdcc4448df53e8032e0f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120389, "uuid": "783d742e-b31c-4fc8-9a1a-33bfbc980ab6", "value": "E5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120389, "uuid": "7981c1a8-ec60-4ee4-8f99-e04ca54806df", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120389, "uuid": "f4145469-aeb8-47df-811c-ce237a4eb0e4", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120389, "uuid": "b1c7958f-e9e7-45da-9879-782ff1b11c55", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120389, "uuid": "9f118052-5dd2-44de-bd4f-99654fd31dc9", "value": "document-425069519.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278b3854-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617117927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117927, "uuid": "4fbdd162-fc0e-4de4-8f19-47a8f353f853", "comment": "Malware payload", "value": "63e90b71b6ee6f4f87b80d51efa876fc", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117927, "uuid": "364bf6ae-de33-4471-a06b-98f785f4c39d", "comment": "Malware payload", "value": "23554bd0fc2837cbab37ebe01d597044a6771e5fba2a26211b21983d245ad4c1", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117927, "uuid": "d025c3a7-c4ec-43b2-ab8f-b6667d886804", "comment": "Malware payload", "value": "92973c158ccb15cd58c83379a31bb2466f0cfbd8", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117927, "uuid": "b1d59d09-9d8d-4517-b9b4-52faf9118384", "comment": "Malware payload", "value": "d74c34fc1f2cf2b8155622e08511c0188479e3b1485c29d43ec96bdacb03e78d1f3fb19b67830036227b318426268c6d", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117927, "uuid": "01e0b447-c7ec-4bf5-a3c7-724eb71028b0", "value": "2B51A51AFC47D14C9BB9232BDC978922FF1B401B9DA2104CB1DCD2495F30809A6ACB8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117927, "uuid": "a25d8768-5fa8-48df-b19e-ca604cc5321d", "value": "48:kxE48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:9GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117927, "uuid": "f6d03320-ab2c-4e72-a7a6-8186fa78aed6", "value": 3115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117927, "uuid": "295c4f06-92fc-421b-b487-6020e7984053", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117927, "uuid": "cb88fe26-8c3f-4773-8604-3ee0c67f4b7d", "value": "0UAqFBaP.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d33cc1-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106594, "uuid": "2d3dedb3-240f-4266-90c6-20b57e0fd509", "comment": "Malware payload (Formbook)", "value": "fbbad3106a32c41fd44f16bcb1b150b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106594, "uuid": "e75cfb3e-34c8-4eb2-b0f6-aa646fc3897f", "comment": "Malware payload (Formbook)", "value": "2361f2a0e93f95a1019650c9b77f55014f9355b5b85ac8dbbd5bafb6b0cc967e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106594, "uuid": "d7dce4ce-7407-493f-b729-362eaa789a64", "comment": "Malware payload (Formbook)", "value": "de1d4b4fe9b617c7b4eb238ad18a432d60f34ff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106594, "uuid": "94f36e01-0187-4a4d-aafb-e1ef1ac80294", "comment": "Malware payload (Formbook)", "value": "04b1271b9d5e6a30a4ac4d437e5c21ccf26a50eba64fdda569893d74537a87d1577c82e8c970d6221b66d6be5a1368d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106594, "uuid": "5c653633-bedf-4e2a-a0a3-d86835e0ad37", "value": "5AD480A870AE405DEEB46B34F5B595821FC825321F62FF3F28E657006CA3769FA4E510", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106594, "uuid": "76d9c370-c943-46e7-b147-351b350fa4fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106594, "uuid": "955e72cc-4070-492a-bcb2-957f23729aec", "value": "6144:qa3zl3f1HNfEbYhZYJyGGtg4ZRrkb8L7YdR7OY451TNeB1ma8bim/F2dn5WE1/L+:LBEbYhlLC4ZRrk3LX2de1ibnMjV/6Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106594, "uuid": "e9304f75-6c03-469d-bb75-548f5f8fb3c0", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106594, "uuid": "8b742ca3-d436-45c8-9a9b-4d58de9a0025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106594, "uuid": "3555b0ee-7b75-464d-a1d0-0cb4f461b371", "value": "P33021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3af451a-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120712, "uuid": "382765fa-a9af-48be-8a69-0692f1adf96e", "comment": "Malware payload (IcedID)", "value": "8bc4204b522bb85f57a5a33844c8acbf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120712, "uuid": "95add975-d8d2-456f-9ee4-6ceebad5b655", "comment": "Malware payload (IcedID)", "value": "23ea16aa18ce6b096ec4499d28c937a9ff59bedcb63584a840e0b72cc237e5fe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120712, "uuid": "c04253b8-f30f-43c1-9d51-5dc8ff5fa9d8", "comment": "Malware payload (IcedID)", "value": "79c61ebe15fad8c4b2a2b6bdb9d0d54a9509277b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120712, "uuid": "566db5f3-e09d-4734-8bd9-eb2a3ccf5566", "comment": "Malware payload (IcedID)", "value": "bf7f1a8821a4f030a97bb47f019b919c65d7693c9dc7708e87913cc35f7b4cf2eb2390f81bda9a3e01548a696046b455", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120712, "uuid": "c715e112-a4de-4d44-91b3-1ca6ce5ea871", "value": "7AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120712, "uuid": "b695418c-2d69-452f-9064-2ee8d9bee5af", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120712, "uuid": "9111b339-c390-4938-a1cb-0070b8096f1b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120712, "uuid": "28b81955-4750-44c2-820d-d462826c0ce9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120712, "uuid": "9a4984f7-358b-47c0-9657-0b9cd1860f66", "value": "document-1455244992.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd65bbb-9146-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617101586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101586, "uuid": "a3bc21f3-b1ad-4457-a41e-0a9a769c93b0", "comment": "Malware payload (AgentTesla)", "value": "9125cfe1da99ea9dff55f6a77ba3efb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101586, "uuid": "531c6c36-e68c-46db-a09c-0db256106189", "comment": "Malware payload (AgentTesla)", "value": "23f395feba9af97086e3c3dee7cde812ad67a31cc151d9285b2fc7b2f926bc4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101586, "uuid": "d10d3e62-e078-409b-858f-2d176d3db125", "comment": "Malware payload (AgentTesla)", "value": "f15e537387e7536bce3d6b1b45798590f8004009", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101586, "uuid": "545f7e08-5cc8-4bc4-af90-771f1aed19e7", "comment": "Malware payload (AgentTesla)", "value": "3792361fa19d459822f12e1d61191143a67bb631015bac046b1ff988f3d1a2080c346d1380820f7c47c964c5043f4987", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101586, "uuid": "0f8fcba8-bfc1-42cb-ae9f-2359580a989d", "value": "7D14E32055EE584AFAB36F504AE0B896DDBEF7E13B1691CA0460434FDC09F906DB06B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101586, "uuid": "396592d1-f4df-45a4-b23b-a59ed5fd3f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101586, "uuid": "d7e3e193-b763-45ea-bf93-f7e97169ac32", "value": "768:At3PxgGAGpGzGHG8GfGmG9GkGeGMGLGoGcGOG5fIh9:k35LfC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617101586, "uuid": "02a947f2-f3ce-46bb-af93-eac7242cd0e0", "value": 194680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617101586, "uuid": "b014d3c8-a8ef-4d1e-b744-16285268f828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101586, "uuid": "663ba91b-d613-46a7-bfe3-ee6ef5a79edd", "value": "RFQ-10092-PO-88277.PDF (234KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe18583-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123095, "uuid": "4fb7b630-4bc5-467c-bf1b-28f53756ba46", "comment": "Malware payload (IcedID)", "value": "02dac27dfde0668657ddfe2d0aec072a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123095, "uuid": "6da9c3b8-00c7-4ee7-be37-d926f3691ffd", "comment": "Malware payload (IcedID)", "value": "249c42bf328ab7cc321da48fcc9d2ba3ffb8afb160776f961554adf8605f894e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123095, "uuid": "187332bf-152d-4ca3-aedf-34cde5b07854", "comment": "Malware payload (IcedID)", "value": "f153e2514d0ab30915c3a1be62492995dff9ab08", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123095, "uuid": "fd96f487-2200-47d0-8673-c2d0ccd91220", "comment": "Malware payload (IcedID)", "value": "82e8bc6699d96bf23a79e5e3330d2d753939ec7ca81b7b71ee2779064601ed2c5f5c5fe1a3408e30736c6b2581862259", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123095, "uuid": "65916146-5c8d-4663-9ec7-8292ba18ad47", "value": "8CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123095, "uuid": "0e4fe366-b6d4-44a1-a899-34fbb03ad3b6", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123095, "uuid": "f71f350c-7e00-4d8c-97a8-f6b35f7e2f7f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123095, "uuid": "7ee71e4f-b466-4d11-aabc-c751027d6a9b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123095, "uuid": "8dacaaf1-bc09-4307-ace5-52fade639298", "value": "document-1396056757.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b4f320-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120198, "uuid": "005e666b-f78b-4f75-91f3-81d768e1653f", "comment": "Malware payload (Dridex)", "value": "d6e8ad42f04f6eaec9e75a640278e2ed", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120198, "uuid": "90d986c1-e1d6-4b8f-9a83-18d68e4b7cc5", "comment": "Malware payload (Dridex)", "value": "24fb1b75515a22d164b3c0f615b821a102b0e0f9ac41ee51a6cba6cefa5bde38", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120198, "uuid": "cd8eed6d-3991-40d8-8ef2-65748b36a0d1", "comment": "Malware payload (Dridex)", "value": "f9cfcfa00d75594b73f0d8a8a94e3cd63eda2d7f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120198, "uuid": "08594486-df96-4f46-8e4d-381de1a6faaa", "comment": "Malware payload (Dridex)", "value": "462f4367004056bf12c509eb8a5657eb59c4f9007cb52f832551d25c2b8bca7077852f87f4f1e78176bfb9f0223f7a60", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120198, "uuid": "120f8ded-b564-4887-b9f1-c7f63b05bdb1", "value": "6514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120198, "uuid": "cf663270-189b-4440-baf9-5791ae03031c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120198, "uuid": "8b767517-4fd6-423f-88fd-b44b1e0f5cec", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120198, "uuid": "2b1702ea-0fcb-4645-8b6e-4b3d91072ca1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120198, "uuid": "8703dacd-b2ba-4522-bf9c-19c15563742a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120198, "uuid": "43c5e09d-6371-412a-967d-468aaf8d56d9", "value": "24fb1b75515a22d164b3c0f615b821a102b0e0f9ac41ee51a6cba6cefa5bde38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a535c48-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617082766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082766, "uuid": "09c48968-3fb1-483c-a3ee-8aece47ad472", "comment": "Malware payload (AgentTesla)", "value": "b294c67a236509a918a875f8099415f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082766, "uuid": "b2f0bd9b-c45f-43bd-8329-72e0d6071b4e", "comment": "Malware payload (AgentTesla)", "value": "2500f0158707c23a25dd46999822ba0f1891d1645a998f7808faf4fc0fde11bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082766, "uuid": "967596ed-4aae-47e0-88e9-2df65f5191f1", "comment": "Malware payload (AgentTesla)", "value": "76dcfc03917852de966376bb8277dcc967f15045", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082766, "uuid": "b769ee25-bcb6-453d-ba0c-1beba34fa7d8", "comment": "Malware payload (AgentTesla)", "value": "f7feb0106c05a656b563765ea2492a2a5522ed75918516dab69d459711371b34a30d6c3e07e02591966fcfff29b7aa43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082766, "uuid": "3113345e-33fd-4691-ba17-011368cf9099", "value": "0F05231D5984C54C702E74EF279EC07A40AD5FFBB8BAF70CB6A48B918E9994FC600D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082766, "uuid": "ff96c1fc-b67a-4b63-be1f-fbec15a77aa2", "value": "24576:7EQMghZkDMDmyz9w/cFFHVvJ47B9T8lqQox9XyzE+HMx:7PZhSwSyz99HVvJyv8lqQo2XHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082766, "uuid": "b8f2610e-add4-4446-ba34-c163a0c53571", "value": 819204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082766, "uuid": "609abbd1-213d-40ab-9502-5c696bde60ac", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082766, "uuid": "89fd28cd-f6df-4df3-a578-706520bbb94a", "value": "QUATATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0338e330-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132898, "uuid": "881e4988-9a83-489f-a9c9-27d22b1b1f5d", "comment": "Malware payload", "value": "1a5e5626b00c66faf8c91d0b869def11", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132898, "uuid": "251c9d07-8a46-4fac-9e77-8fba75ddfbd8", "comment": "Malware payload", "value": "2515b2616195c225230e400192193d2bfde277a03afa6dc71b35cb91dac34758", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132898, "uuid": "4c7c87f3-0863-4d93-a95a-dae0c5a1bc98", "comment": "Malware payload", "value": "696f9ecb4c449e746826f05c5cbaf3c17e08c1ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132898, "uuid": "a53de0e6-cffb-4d48-bbad-6d6f69734329", "comment": "Malware payload", "value": "8009d9ddf839871c625321494b3e0276a5f72ca53f86f1e0871383c3ddb401121ae41ad637808d43536e287c4ad1f13a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132898, "uuid": "faefd5c6-be52-4dcd-bdb2-652a5e4bcba9", "value": "DE14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132898, "uuid": "38ee9546-adbf-4a5d-acce-2e0dcf02fc53", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132898, "uuid": "55b42448-d75c-410c-a158-90ed58e7f727", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132898, "uuid": "bab17661-9dfc-4355-997e-87b750ef7ac3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132898, "uuid": "64e8478e-eac5-483a-93f3-0666234a09e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132898, "uuid": "90e348e8-457f-4607-a816-4a18eb4aa4e9", "value": "2515b2616195c225230e400192193d2bfde277a03afa6dc71b35cb91dac34758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8f32a5-9186-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129372, "uuid": "95dd037e-e9fa-4097-8ca4-43a4efe5323a", "comment": "Malware payload", "value": "41972b9c53e80258ee5690513d32cd80", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129372, "uuid": "cfc48381-322f-4d85-9d59-c3d6a6762c82", "comment": "Malware payload", "value": "25e1506b1bb79a99b50c8ff61c44ed0caf8fceb9505b276060e39efd57d62cac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129372, "uuid": "ffaf71e4-efb2-4091-9d15-f87baf36b4e4", "comment": "Malware payload", "value": "4e8d50a99f6f6166d5a3b4e5c1c731441f825130", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129372, "uuid": "875891b3-eae4-49db-b4c0-c7bc0f37960f", "comment": "Malware payload", "value": "d03dc7dc0d7469baf3f6fce53ee3ac6cc354547ada353b2fcdf494913fc431e309231e4d3986d9ee2181fac6ca2102f9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129372, "uuid": "d2e08a2e-9415-42a8-86eb-14f4a3526537", "value": "0714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129372, "uuid": "37ff461a-f856-4399-adfe-10e5bb55b043", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129372, "uuid": "4d2b205d-c04b-4236-b1fe-252ffaa6f4bc", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129372, "uuid": "62ff9625-caee-4b5c-9c45-adf083587444", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129372, "uuid": "bd70e3fe-7317-4aa4-8fb3-02dc22429da3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129372, "uuid": "a6b989f4-ea21-46eb-a6a5-f0b00e6b4c33", "value": "25e1506b1bb79a99b50c8ff61c44ed0caf8fceb9505b276060e39efd57d62cac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d68c20-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143754, "uuid": "b5c07c5e-c05f-4376-b98a-b33279a5727d", "comment": "Malware payload", "value": "b1dd091745a59f8b996a4cf038766b4e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143754, "uuid": "3bf3a72e-25fa-4cfa-a8e3-f7880d82e973", "comment": "Malware payload", "value": "264e2b1ca6f39e130ecd98a56775999bf252445feec514d600d751a03e6cd7d0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143754, "uuid": "f875533f-d57b-45c7-b2fe-7163752edf78", "comment": "Malware payload", "value": "f904e445411698e9c50ae400aaeef0ceaab98a8f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143754, "uuid": "199b126d-28b5-42ea-a403-981bde20c729", "comment": "Malware payload", "value": "edc16ce7559e78eba2a1a049f25359ddef034504043bd3841e1c709bed8d7993b17bd3b1fbce6b713dffac0f141a555b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143754, "uuid": "d291baa0-9603-443c-a4c6-ad9c75468272", "value": "7314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143754, "uuid": "cf1a704d-f64e-44ba-9afd-56d4277d5fe5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143754, "uuid": "7a5a3632-5276-4fc6-a50b-fe3b78926a5b", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143754, "uuid": "99536cd5-4c06-4222-9862-bf29b10a91a3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143754, "uuid": "a43f3598-cc15-4bab-b1d7-28f9bea2edea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143754, "uuid": "95fd3fe6-d400-4a04-817e-3f36f62e530d", "value": "264e2b1ca6f39e130ecd98a56775999bf252445feec514d600d751a03e6cd7d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd5288f-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617087923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087923, "uuid": "ce4f368b-020f-497d-bad5-057fabf31136", "comment": "Malware payload (Gozi)", "value": "e72af5335ae4edc445b8159077ef48ed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087923, "uuid": "22644f65-334e-4d0a-8c26-19f7e5afc3df", "comment": "Malware payload (Gozi)", "value": "2669050ec7f2d8f1def908e09030bc6a0fafcff4ed60c9254f40425a6fb1f887", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087923, "uuid": "e3441348-f100-4a5a-9ec7-6d334fea96d4", "comment": "Malware payload (Gozi)", "value": "acfa4c388fabff83d95350cd13d543e2b42b2fab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087923, "uuid": "0fe15f87-5877-4454-89c6-a29e56b5ccae", "comment": "Malware payload (Gozi)", "value": "dcd2a47611edbe08af2e24373e1c047fd8aed5bc947227b6de09c3cd6fe4f934f256d33c790a97648601509759b5db66", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087923, "uuid": "92c81d09-7219-47aa-8376-5e81a1c2472a", "value": "1874AE053BB0C5D9D2A521B44ECD8EA4E924FCAA1F20D21372D975DCBDF9F89262D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087923, "uuid": "95807aa0-63f0-4b35-9100-a1dbf8bc7de8", "value": "77af713b1f2916ea138f9bb7258cf849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087923, "uuid": "a58e0ce7-e88d-45cd-aca1-9fe71d98a911", "value": "1536:bepG5ACCny8GenidAHcz92ZIx9FxIl+YkSVoZlP1usBVEwnoxJashnXcX:36lGeExx9FmSSkfBt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087923, "uuid": "8a93286e-47d8-4e60-86f9-d80d9c14ca6a", "value": 368213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087923, "uuid": "4891c5f6-ddab-4d50-900b-9a486d6e50de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087923, "uuid": "c5594a54-9c8a-4689-9c85-07ac655c923d", "value": "e72af5335ae4edc445b8159077ef48ed.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8108350-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120719, "uuid": "e9546d18-432c-4a8b-9ff9-35f2c3a2b642", "comment": "Malware payload (IcedID)", "value": "6f1bcc04e997f22aa2362a168fe706be", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120719, "uuid": "f30761c7-cc4a-41fd-9aec-ff45fbaf65b7", "comment": "Malware payload (IcedID)", "value": "2677b0d687eaf958b712b6cd821596f39e47a441c34c305099cce09d215cb1a2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120719, "uuid": "72c8540a-28b1-4990-921e-ad29bf5624e9", "comment": "Malware payload (IcedID)", "value": "a59accbf25610c6eddee7ed0df37ca5c5bef6414", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120719, "uuid": "e2b5a4f4-a902-42f0-b715-eabb51be9ed6", "comment": "Malware payload (IcedID)", "value": "b91938f7709fe29a18bcaf385c6d7027c97b94146baa3ffddd598bf9e6e81a5e7ce4a1d6b805b07cf6850d13cedbcaf1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120719, "uuid": "0cd4407e-adfe-4a6b-b9a6-f24b7bc82138", "value": "86B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120719, "uuid": "80117191-98ba-4369-adff-64be204b710a", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120719, "uuid": "f00bd312-29e8-471a-a2ca-547634eec822", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120719, "uuid": "ec4d51d5-31af-408f-b5aa-4ad952ce2f7c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120719, "uuid": "26468d24-3f3d-4190-b52a-9f161dcde45c", "value": "document-2067492496.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a97679b-917b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617124374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124374, "uuid": "458f127a-1f33-4b56-99ba-8922ecbe9935", "comment": "Malware payload (Dridex)", "value": "6f5c5645503a3062d0c8fc01ea30e1b3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124374, "uuid": "c71354f7-9ce2-4a48-bde9-434bdc23ea49", "comment": "Malware payload (Dridex)", "value": "26ccc6491fd3c27f50d194c2ba6f78e66172bd8c69ab6f257f82e3e9b75d3b8e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124374, "uuid": "3874c0f5-949e-46f1-a7da-e930765f77b7", "comment": "Malware payload (Dridex)", "value": "ed8aedfe37afde5350336a2445a6e3cf42c64b54", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124374, "uuid": "5be541b4-5982-4f56-a577-7f97a09e0992", "comment": "Malware payload (Dridex)", "value": "50b016260d81ffa69679f00fbdb4d02fa57ef336360ac4ed77a20af50ecda0fe1ce1f1417b38039347977cec5f504991", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124374, "uuid": "1d96f4e4-6717-4aa8-8129-7a222816e8d7", "value": "D814BE2DE333D495FFF7CAF41492AA2A8A7B2D40822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124374, "uuid": "3feed595-192f-49fb-a67b-654d453e6ddf", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124374, "uuid": "cc880840-8460-4039-9746-ed36e295faed", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124374, "uuid": "84f52b15-67be-4fe8-b1e3-1b4a8bc312f6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124374, "uuid": "98cb3f71-0f1e-4de3-8324-ee5b3be73dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124374, "uuid": "c8d06744-932d-4b0a-a5ff-20537e953523", "value": "26ccc6491fd3c27f50d194c2ba6f78e66172bd8c69ab6f257f82e3e9b75d3b8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf14a13c-911e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617084680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084680, "uuid": "5e8b24b1-c057-401a-9edf-ba3c2b954756", "comment": "Malware payload (Formbook)", "value": "03ec79ddc55f8595b1f318f520e725d4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084680, "uuid": "dcb7f65d-d9ac-45a7-9d98-b1ff4bcaa633", "comment": "Malware payload (Formbook)", "value": "26dad02161fb66674aa5e7fc8cca936d2273287ae31fd6e839c6200d5aade0d9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084680, "uuid": "525f8043-6fa1-4b10-a9d3-e59c746b1aee", "comment": "Malware payload (Formbook)", "value": "58d509e6fcbb4883c559ea468e89e30e2d01e918", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084680, "uuid": "012bf34a-a364-47f1-b0b0-d8bec9a5e2f5", "comment": "Malware payload (Formbook)", "value": "0cf3de59dcb30949456db5c7643adf4089d70dd366d5215493e88d609d9460e6d3851737c5b7ef6e7a443bd53dcfd6c5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084680, "uuid": "079164cf-b0b5-44c5-a34c-b978a938a8e3", "value": "9FC53305D885DFE6C22D4EF1E65E952B085CDEA82F008C027B1D7F927D72630B7A6B58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084680, "uuid": "2991891f-84c0-45a1-b291-4e1770a00847", "value": "49152:rPUeIQ//iAEtBMsuwZtEQ2rj4Y7CWN0+nL3Qvk3dKgaB5amYR0gd5U1HJfiareF0:rUNUi3BMs7ZtEQ2rjVN04LOgaBkXaJf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617084680, "uuid": "08c5066d-8419-4c82-9c50-a1f6057bdb94", "value": 2599424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617084680, "uuid": "24fa89ea-1719-4ed0-aefd-d5bd83b73fdf", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084680, "uuid": "844290f2-1796-4f69-8b86-eb91b371e325", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fd8d5e-9194-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135340, "uuid": "4827bc38-8add-48aa-a4ff-4d02869ce40c", "comment": "Malware payload", "value": "da33d8d55c7759a4568d40c50ed75889", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135340, "uuid": "b394b5d9-497f-4492-9c25-818aaa364cb4", "comment": "Malware payload", "value": "26ea4c72b2afa11d6de1a1a149962a87f2b28e7553cb3bccdb372f6312ae789c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135340, "uuid": "ee61271e-7be0-4d10-97a4-1e90b4a3346e", "comment": "Malware payload", "value": "21374f5d1ad2a46fcfab1a7bc53e2a9a68411a09", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135340, "uuid": "92c110d6-f1ed-4891-8254-819b46a3fd7e", "comment": "Malware payload", "value": "b6bae89bfb248d5f2f78b29b00cbb952c5f8a382213d9d11e04828135a90ff4b9eecc66ebf79a472f33f61438ac458ae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135340, "uuid": "aa4659bd-fb47-45e0-b322-59be14fa560e", "value": "2214BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135340, "uuid": "da2c5873-d862-4a49-9ed6-585d03805ddb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135340, "uuid": "12eeabc8-0216-47bd-bbf2-58b8515b934e", "value": "3072:n3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:/Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135340, "uuid": "da4e60a4-fbb2-4247-9a20-94372234bf4a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135340, "uuid": "4dfb6edc-ec03-4b4e-af50-549c733d487d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135340, "uuid": "3b41d107-ae05-46bf-9e90-c30f9712958d", "value": "26ea4c72b2afa11d6de1a1a149962a87f2b28e7553cb3bccdb372f6312ae789c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f20cdd-919f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617139967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139967, "uuid": "9160d686-ad64-413a-801f-75540b18dda7", "comment": "Malware payload", "value": "87e4b79e02c038bb1dda5e53bd502703", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139967, "uuid": "084a58d4-83c5-4812-b0fb-936edc0e4542", "comment": "Malware payload", "value": "270cbb3393119258ff8db610d8b48556b582c3fcd1bfeca457a6311b5cdf0908", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139967, "uuid": "94bf53a4-701f-42dc-914e-88e33deb30cb", "comment": "Malware payload", "value": "fe6083dfea6a0727e6f9ec215fa1bddd6a981b8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139967, "uuid": "3e339948-6ac1-4064-a9c4-9c1c937b40bf", "comment": "Malware payload", "value": "0a6b675a6c51fbbd178323467bb6df52a362a99304127c193b61751ea989e0c329bfb9db3e83b0e511bc3297cf348887", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139967, "uuid": "4e394082-6e8d-4ad6-81d9-50242f143348", "value": "5DD4AF02A7E18034F5B31BF845BF64688ABE79E0073880DB52C425ED5B37AE4AD3475B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139967, "uuid": "8e4cae59-6352-495d-8e7a-b1a16c6ac355", "value": "68f3f2a2ffe0dad5256ecadb0543767a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139967, "uuid": "cba6b768-ef86-4783-9e21-6fa98ac07626", "value": "12288:eRNmLFMfAqHo/W5ChAUCEFAyjbMuYjUX3VoEuh1+RoqfxWh9x01qM:mKMfAEo/PhAVPEcgRHfIKoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617139967, "uuid": "b7ab08f4-1be6-42ab-bcf7-33676f0a5ed5", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617139967, "uuid": "e29fba82-ccc1-4cf4-a337-7935d205e9e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139967, "uuid": "8304f740-17b0-4ab1-9ca0-dfb66532104e", "value": "WIm6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b0e8c0-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108770, "uuid": "65337478-d9ff-45f4-8649-dd4e95f35621", "comment": "Malware payload", "value": "ea7e9f627747fecf646a59057e53f3d5", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108770, "uuid": "b23edfcb-e3d0-4a64-b1ac-7dab6c872a04", "comment": "Malware payload", "value": "272dc7f50854641c7cb089541dc1974ccdeb42561969bdc8641d4ae889b42bf8", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108770, "uuid": "54386904-75b5-4900-9951-a85090799641", "comment": "Malware payload", "value": "17970a6d84626f69d34c6533c9db04c11310d91b", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108770, "uuid": "bfff438e-64ed-47ef-99b7-37b5eeccbb60", "comment": "Malware payload", "value": "2ecd13c1533662dcdc969a82364a535815da4eae7822d273a75ab3455bb6213312b65fb1f70011dd222ae10cf0cb1e42", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108770, "uuid": "813e80d6-5a7b-42ba-b5ed-4fefe948e99d", "value": "C083128DE08492C0236FEACF54FC94615D136814EA99F7E31B6839CDCD4DEA6B450B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108770, "uuid": "38ea9c91-3cf0-42e6-8055-2cf636be3a32", "value": "1536:PkPb3vwy/Sbfc2e9gssYQGmc2Xa/URV9tjAbnMP8tc1C/Ck63A07rx+Cp8:PY7w0SbOgVLc2I+95QMPBC/u3AA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108770, "uuid": "6f73be4f-8edb-4c5e-aaf3-cf064893a7d6", "value": 86547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108770, "uuid": "36be7dea-2bd2-4311-92ca-26b69bf02145", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108770, "uuid": "8d6c729c-57c7-44db-b2bc-c6ac292297d7", "value": "lista_1823.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb92c28-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "0b82cf27-6d26-434b-b6b8-c4580bad2c37", "comment": "Malware payload (Dridex)", "value": "e47b5246c9d341f994687ad4dcdcf42d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "e9336946-f217-4c05-8ebf-456a4abd7a50", "comment": "Malware payload (Dridex)", "value": "279b531c7cad6d2f08b1f59cf172efb8ffa9db19f1d276778c886bd5997bdfe0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "6f3813ce-bd12-4586-a28c-280e72d1575a", "comment": "Malware payload (Dridex)", "value": "ff86ae4e5c5f7eefed5f7bc66dec4d1c3f02b3d8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "004cb20d-51b8-4eaf-bcfe-66ca21638189", "comment": "Malware payload (Dridex)", "value": "da318bf5bc0fb008265fb2b160272467b16e015214306246cf450f04c42a93676867647bbaee7270cabc8df8e46d84c7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "fc2129c3-f28e-4921-8ea0-c0b4147f1547", "value": "D514BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "43b78a4a-b7f4-4901-8d16-e0f4b8030a40", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "c2faf032-623e-418b-9cbc-361e81e668e9", "value": "3072:a3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:eJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114316, "uuid": "eff4f4d1-7dcd-4128-9f40-875791312d5d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114316, "uuid": "4e645bae-7f91-42c0-b83d-66ef07e87409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "4916799b-49ea-4559-b1dc-ed7f558a3845", "value": "279b531c7cad6d2f08b1f59cf172efb8ffa9db19f1d276778c886bd5997bdfe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9d9808-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120700, "uuid": "481230e9-515e-4d10-8d98-ca44f97c2641", "comment": "Malware payload (Dridex)", "value": "9858dd52f577d0360ebd8c736c9fe635", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120700, "uuid": "67d101f0-e951-47b8-b27d-b8e99c2a3987", "comment": "Malware payload (Dridex)", "value": "27a530cc06c699d5a86b38f863be0bd8d9573e25e96d5e09e2b35a600c75bf5c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120700, "uuid": "0b05003a-8165-4f90-878c-636c566dbc50", "comment": "Malware payload (Dridex)", "value": "8a31a2a8b992c1638e7fae2ff79b259a0ab84743", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120700, "uuid": "83acb7d2-436c-45cb-82eb-a5effd9afb2c", "comment": "Malware payload (Dridex)", "value": "5e78117fa7795ec5a99b46ef59ef1f03b0240e95eadeb78757ea71cf6f3d5e936fe9cc80686eafaa27f8dbc7b223d523", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120700, "uuid": "a50c0826-6df5-4e6f-9648-f32b3af5fdb5", "value": "4F14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120700, "uuid": "801120f3-8d67-40c6-a747-c5c41b115063", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120700, "uuid": "223e71e8-fd73-4389-a013-6d18b2717b67", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120700, "uuid": "afdc7464-f645-4faa-9917-63051cd53298", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120700, "uuid": "1c04caa1-ae76-4b78-9b12-3b8093c96202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120700, "uuid": "cef5d253-a8ec-4042-89f3-b2f789fe5d74", "value": "27a530cc06c699d5a86b38f863be0bd8d9573e25e96d5e09e2b35a600c75bf5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75706f61-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126218, "uuid": "cbedf150-7b09-4275-b32a-abc9ce337f0e", "comment": "Malware payload (IcedID)", "value": "ffe7204426c339766bfd9146750fd4c8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126218, "uuid": "ad042627-d04b-4c33-b8eb-99cb4f5f869a", "comment": "Malware payload (IcedID)", "value": "27f39954ae5f9a1be4a456ed55dbd4b56194729ebb1f23f66c0bdb08ecdf3a20", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126218, "uuid": "87716413-97e9-4132-95b0-6c2c8b1bbcb4", "comment": "Malware payload (IcedID)", "value": "1bafb4d18b62edb91eb5b148d23f3a263ebbf1bf", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126218, "uuid": "9d610a75-9975-4f69-be24-834d54b1b25b", "comment": "Malware payload (IcedID)", "value": "f701a053dbd5cf132967cdcca05063dc9c082f50cf9d91a9a0fc1ff28d528a07eb0b15ebcee08ff93cec4b250cdba837", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126218, "uuid": "dc716ef4-86ef-4116-b2e8-773e93513c61", "value": "DCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126218, "uuid": "efa6d683-362a-4196-929e-36d3cf34ee11", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126218, "uuid": "71423601-e827-40ad-ba51-980df0f09965", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126218, "uuid": "95156ad2-3d92-4cea-9c69-7a9453be4aa2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126218, "uuid": "29dde142-99a2-4dd9-a6a6-119e05edcde1", "value": "document-1163003907.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e60b10-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126598, "uuid": "ddc1d652-f0ae-49b8-80e2-ea3f5111b291", "comment": "Malware payload", "value": "3f14b9b3f52fb2191ff0c5d28752baef", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126598, "uuid": "0c050ded-d70d-41ae-a45f-2e0802c17e3d", "comment": "Malware payload", "value": "288a974533053fff27fc936cd239c942ffb3ac6492e4b18ed16f6755fb02a4b1", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126598, "uuid": "361c0024-5a05-42e4-bce8-8ec57b74de13", "comment": "Malware payload", "value": "e69b2e4a8520f6dd259da79ad1566060d4515765", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126598, "uuid": "903a1c74-3ba2-4ac6-a08c-7fe7d38d1956", "comment": "Malware payload", "value": "19f277196dd73d272b470315550c32c6d7fc062bbb0d755b534124f2e38fabbd2bb807313a279dbb86f584c7353e44a7", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126598, "uuid": "44a09c7d-7b3a-4d73-a661-0913be424cea", "value": "27B3E08E7684B90ED38FB53E9906A4EB2D534041E736743F3678BB0D10BD12B4F5A58A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126598, "uuid": "ad573b9b-0a99-4ec9-a8e2-cc92fb11980c", "value": "1536:aWQYz6FWDz41w/+VAOucniGlvpTv7xVMsigZEQNggMorCKjTOzoIbe7u5h2dPYJD:acOkI11eGFpTdV/vEQSlcCEk9by22v0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126598, "uuid": "80226f0d-0963-40e6-95a5-83756bba01fa", "value": 109614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126598, "uuid": "57fed813-8d54-4f3d-abf6-4eeb10f2a0da", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126598, "uuid": "421efcb4-3a20-4311-8914-ba07d8543329", "value": "operazione_288.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0676de-917d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125239, "uuid": "e014deed-2ea7-43c6-a926-b70d77acd1ba", "comment": "Malware payload (IcedID)", "value": "1bed5af5996ed4003ec4731f1cb12be5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125239, "uuid": "84f8b0ff-a514-4678-9e4f-6cb0fb58ae8f", "comment": "Malware payload (IcedID)", "value": "28b4fd85432f8f2dbd3cd20d373c67db8c3712b0406272a2310a3eb068f7eff5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125239, "uuid": "50937e6b-c64a-4622-ae21-f81acab5517e", "comment": "Malware payload (IcedID)", "value": "de5c23e67d0527dd6f5d7ca32450a344c97492c4", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125239, "uuid": "99f3ea3b-38e3-4fe9-ae47-089134fc9aa6", "comment": "Malware payload (IcedID)", "value": "b31f05f8678a8cd1983f0f47f0382188c52daf04fb5baa61a81eb46a2a1c33afa0419d821ae06acc9653262009f68247", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125239, "uuid": "9694477a-191d-405e-8b8e-1250d86d71eb", "value": "5CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125239, "uuid": "664e3e44-9dee-4052-ac12-eadb02cbef62", "value": "3072:Y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:YzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125239, "uuid": "d1017ce0-760d-4b1c-8068-79452236f978", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125239, "uuid": "f619706f-c074-4bd5-b0af-d5767243babc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125239, "uuid": "9d33070f-7590-49de-8371-9b4ceed61668", "value": "document-1611659440.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b617c84c-90eb-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617062761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617062761, "uuid": "0b9c21ba-6d6b-446f-8d0c-110aa0596dd3", "comment": "Malware payload (RedLineStealer)", "value": "f5c32bdd6d417d9b63c73157e0cdc37d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617062761, "uuid": "183180eb-ffb9-421a-86c7-aa2f0067cfc0", "comment": "Malware payload (RedLineStealer)", "value": "28cfc294ffbc51f8dba82ca8db6f7ffce91c854f9145a3bad7a5ad59bba46e54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617062761, "uuid": "d2060010-deec-43c0-bb34-245f9b0d5796", "comment": "Malware payload (RedLineStealer)", "value": "a2416bf9c0a9c127b94a1f09dfa05751092fd377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617062761, "uuid": "7b99e5bd-4ae0-4fc2-ae0f-cd0bfdae5b98", "comment": "Malware payload (RedLineStealer)", "value": "01c0c8715ecec63aa28b52b13415e405923273fe9dc4914463ee268db6b5359e6000093176f0d3b87abb1fcd3083a3ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617062761, "uuid": "72c57fbd-e981-4e7f-8939-0381f78c5cca", "value": "75B4BE9527B9D58AC0599330BD714260273B6E39F6CED77D40E8FAEC8D7630638686C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617062761, "uuid": "1df2ff62-4984-48fe-a97e-53d5630902e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617062761, "uuid": "f1de0b05-a106-4147-9f2e-e2286d20b07a", "value": "6144:RxoK8LrVeUpxXY6Jf2e2wI0rkIbwVjKEtbnjpuMhUY6g6VJrY9cdjL:wVp6E2e2wR/0VjPbVuMhvf6vrNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617062761, "uuid": "20a35652-5c39-4fd4-9e49-12d278787224", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617062761, "uuid": "a1f9ea89-d01a-4268-9964-b91d235b6b7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617062761, "uuid": "80edfed8-8fdc-4b76-b0fc-32e38e774d47", "value": "F5C32BDD6D417D9B63C73157E0CDC37D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733501d9-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120631, "uuid": "5ac83c69-e069-423d-9089-068f900a96b2", "comment": "Malware payload (Dridex)", "value": "2154cf172dd6c60a892efca9e906aaee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120631, "uuid": "f74eb5e4-6078-421b-8abe-91e71c9d55ec", "comment": "Malware payload (Dridex)", "value": "2953938d37c8c7d89082191944207b29c28ecf6b886287936a1ee65b1c1e10e6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120631, "uuid": "8145262f-590c-40ab-9170-ceb40ed55c1e", "comment": "Malware payload (Dridex)", "value": "1872d3fa3e4a7dbe149f98c743d99e584b97f96f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120631, "uuid": "1155576a-f89f-46fa-bdab-52e8b334e112", "comment": "Malware payload (Dridex)", "value": "40a54009e37a3f6f97c2dd9e8ca8ce161fc1e0b582a3f3a0f63a34f8695bbc348d42ffbaad9b0992525760f1d9cc0c6e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120631, "uuid": "c939f795-725f-486f-a83c-c6937fd28ad0", "value": "A014BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120631, "uuid": "0c248a05-a00e-423d-86eb-19aaf2755b1c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120631, "uuid": "63b4e245-3c64-48e3-94e7-932c6636c4ce", "value": "3072:U3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:QJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120631, "uuid": "f1ca3339-b1e1-4353-b29c-09b290adc5c1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120631, "uuid": "bb2f4b22-3173-4e29-9310-3a4f3f1d6553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120631, "uuid": "c0c429b5-13be-4f0a-8e66-35da4a4c9c45", "value": "2953938d37c8c7d89082191944207b29c28ecf6b886287936a1ee65b1c1e10e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f065ae-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123395, "uuid": "e807bf56-ab51-41c8-96df-8a5cad58f41b", "comment": "Malware payload (IcedID)", "value": "acdd8c0cb9a40b7d7c729c7f397a4e7f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123395, "uuid": "14659c64-1f16-45d2-91ed-88a698c74727", "comment": "Malware payload (IcedID)", "value": "29c3b87a5ea72abb77faa7c3d9729b1b51fc636d70b983aa4517ac737268dd2c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123395, "uuid": "75348086-6832-44c0-8cce-f08e36232628", "comment": "Malware payload (IcedID)", "value": "da0b72f69ccce1fadb9d9de37be45cf51267fb28", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123395, "uuid": "4f0c5c0e-dc9b-48f5-9b5e-f1d9f60cf083", "comment": "Malware payload (IcedID)", "value": "3864b4299e38c2ae5b1f43efec82a06cce129f2f4e878ff7fab7d8ea6f44a386fa1b7fdcd147e7ff088179d9428f482d", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123395, "uuid": "c74b4dc8-1c7d-408b-be33-3bac496d08fe", "value": "00B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123395, "uuid": "d4b7e848-9173-40cd-8f1f-cbab78117cdd", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123395, "uuid": "04b19226-e0a5-40aa-b46a-17d2b1308a1e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123395, "uuid": "7d8c6a69-c8ab-4cfb-b4e7-65350da2fe2c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123395, "uuid": "71005daa-a082-4b1c-987a-b79ff8f3b344", "value": "document-198918677.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad53c500-91a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617141344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141344, "uuid": "c2108c82-503e-4c19-b3b2-de344ca4e2fa", "comment": "Malware payload", "value": "7e7aa3f414781b15ecd702ffe5ac4093", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141344, "uuid": "352bf454-4c62-4ee9-9cc2-4f67f8bf17da", "comment": "Malware payload", "value": "29df955b9714bcf6b8cf92132adfaa5d7deec5252c09f5f458a964d1cb379d8f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141344, "uuid": "34f552d0-6808-40da-87eb-868968603c6a", "comment": "Malware payload", "value": "abbc1816ea2734d5050c9e3b9def98a231df883c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141344, "uuid": "0c7ba21a-f914-4d89-912a-83c5aa66f7bc", "comment": "Malware payload", "value": "c8a41c2859b51d3d86caa39682688f24628b905c01057600d08099df4b4868a7d7974bf967f0198fb6f62de007f688d6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141344, "uuid": "c2ebe9e4-300f-4bec-be16-a66f5f7cbb9c", "value": "4014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141344, "uuid": "1462e0ed-734f-480b-b012-c7fc65a707f8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141344, "uuid": "276702ef-313a-4352-a24f-cbf869896f99", "value": "3072:P3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:nJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617141344, "uuid": "21d8925b-07b2-4719-92cf-69d1ccfa3db2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617141344, "uuid": "b9f35632-3661-4080-843c-2a3635141f1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141344, "uuid": "43fbe14d-b13e-408f-9b0f-e94484ac889a", "value": "29df955b9714bcf6b8cf92132adfaa5d7deec5252c09f5f458a964d1cb379d8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cdfb70-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617106837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106837, "uuid": "33d338bb-23b3-4d9c-b5be-e735381a1b72", "comment": "Malware payload (SnakeKeylogger)", "value": "0f10f0f0262d9e9fd566fb0e84785000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106837, "uuid": "0923cd6c-e1d1-450f-b68f-ca184241e48c", "comment": "Malware payload (SnakeKeylogger)", "value": "2a4efbaee6dc64555b5bbfcd9cc7c16e55ef2cfc56384afdb1a2393c5ed539cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106837, "uuid": "6dad53ba-bc98-4813-93cb-5a67951530d2", "comment": "Malware payload (SnakeKeylogger)", "value": "ac28c255d103b8adc685fa2b2d61d48295414e1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106837, "uuid": "945c4e63-cee2-468d-91af-e005b14f69fb", "comment": "Malware payload (SnakeKeylogger)", "value": "b44907c0621452e21ecf71fddc7fdfb354858ea152ea3b0aea3a0718e02cad9e203b763ee37f367456cf5122170e53e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106837, "uuid": "e6b9f920-988c-4866-9a06-f3e0126af85c", "value": "93D4A3A870AE805CEEB46634F5B595921FC969321F52FF3F28E66B002C63779F94E410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106837, "uuid": "ce4eeea5-e5e9-4dae-aaab-622e16d244b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106837, "uuid": "c65f73ca-de71-45dc-bde2-089d9bbb8f37", "value": "12288:8SACzEjBbggfRgVIa4Z+z/V2t3dQKoV25p:S+EjBbgg5gWDZ+KdkV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106837, "uuid": "1e1d3b93-16b3-40c0-af9f-3912987670ef", "value": 652800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106837, "uuid": "27901ade-b60d-4199-b580-151a7dd91178", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106837, "uuid": "30bd497d-b973-4bd3-8ce3-6288377a7ddb", "value": "QUOTE_PO_REQUEST_00989_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee88b86b-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136729, "uuid": "51598547-5c98-462f-9b0a-465cf8a077c9", "comment": "Malware payload", "value": "0fc3244fb69957885927439f9e9bcdf9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136729, "uuid": "55d2fc25-eda1-4c30-988c-e2d4e6fb449d", "comment": "Malware payload", "value": "2a60b5de738b0c243bc99758134784bfc44857f4981b067c5a2940beea8d383a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136729, "uuid": "3ba6db27-ba8e-4b24-8969-e2c1aa5652c6", "comment": "Malware payload", "value": "9bcc8a02b75a5039bce57acce72e3378491123e2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136729, "uuid": "8be26c99-b3ae-491a-8811-0fa19e3db3d8", "comment": "Malware payload", "value": "2d9a52fdc80535e26efdb4c5f586c2b2041efc4953f3ac60820edb4d9237f74d2033d0e03f5caf4438058db77677e2de", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136729, "uuid": "deffe303-aaa0-44f0-9e62-a0f6fea77ee1", "value": "A114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136729, "uuid": "d1faa191-6e0f-43e7-98d0-25e6a4a31bb0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136729, "uuid": "df0ca31e-d358-461b-8b89-78b7b2bd79a0", "value": "3072:73PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:bJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136729, "uuid": "9d4108d1-22fa-402e-a0cc-9f896681eb23", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136729, "uuid": "9e54fcfa-deed-4f2a-8470-e103ec23ea55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136729, "uuid": "fe841948-64aa-4886-ae79-a39697194e6e", "value": "2a60b5de738b0c243bc99758134784bfc44857f4981b067c5a2940beea8d383a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99d48fc-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "3d4e51bd-8ccc-4c98-801b-1107842b197b", "comment": "Malware payload (Dridex)", "value": "7dcb4c209ff635f67bfb6cba5421d2b8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "fa2d6993-04e8-4d63-a37a-2415b3aa5023", "comment": "Malware payload (Dridex)", "value": "2a64f3e7551761feffce478f43882741ca206b4aca4eaf44bca3c3036ed7cd72", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "6921172a-d0df-46eb-a984-3acae7122df4", "comment": "Malware payload (Dridex)", "value": "587dbe076b12ada3a0a302dcdec97373b01ada81", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "6d691405-dffa-4c37-9adb-86a394504801", "comment": "Malware payload (Dridex)", "value": "1a489f37261e378eb5317aa1a5f55fa32e512612ebdb71aa0a1a680f1a183f06ea8a7a063bdcb8d6be5d386e3d70bbad", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "0e00543b-fc91-4670-9b60-33765e794bbb", "value": "0B14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "ccda4826-02fd-43eb-9a16-4b2c5bd71cf0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "b51fe851-7bba-4094-bf3b-7ff1db6a2908", "value": "3072:k3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:AJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114306, "uuid": "acdef018-cf34-42d7-bc5d-42bf5fd039e0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114306, "uuid": "ca94a362-38a0-46bd-99f0-7fc7127d5b83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "0546fcf8-6d64-4995-a04f-b9ad230943b4", "value": "2a64f3e7551761feffce478f43882741ca206b4aca4eaf44bca3c3036ed7cd72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22705fb5-918b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131232, "uuid": "5848ae0d-3f9b-465d-b0ee-b8164e20cd71", "comment": "Malware payload", "value": "2d664659387e167d29da98cf42a543d2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131232, "uuid": "c0cad154-e430-4856-b56a-f4a3a2662a7a", "comment": "Malware payload", "value": "2a6f0c55b2457f051fd3b1debde92d590f31ea5a262af1503f5d066ef7ba3fae", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131232, "uuid": "96c350cd-9ed3-4d8c-83ed-e95db55bff2b", "comment": "Malware payload", "value": "877e94ecae8c236f960a2cbb6891ff30813a02a4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131232, "uuid": "5e0aedec-b480-4216-bbb7-f0daa07b11ad", "comment": "Malware payload", "value": "23c6a176fd5076309ae9f9a04a41e845df02320306efecf68103137da1319f1b89a98a2e779e3605c23dea772adf2daa", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131232, "uuid": "6e4aad03-6505-4cfb-8e7a-bb422f6b509b", "value": "6514BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131232, "uuid": "890b5078-f75e-4222-85cc-f0a1e251f7d7", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131232, "uuid": "0c8083e3-b371-4ee4-810d-0c8ef0eba425", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131232, "uuid": "dc62eb38-ab2a-45b4-bc75-4c6e37d134b3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131232, "uuid": "6870ea16-e464-4f2b-a794-95d8f2fd57b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131232, "uuid": "27840560-0723-4bd6-b77b-a120a2e07435", "value": "2a6f0c55b2457f051fd3b1debde92d590f31ea5a262af1503f5d066ef7ba3fae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418614c4-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114105, "uuid": "a0a5c05d-8b48-402f-b403-3072d251b8fc", "comment": "Malware payload (Dridex)", "value": "74672a5a0a8cfd669f432741d5af00d2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114105, "uuid": "a0b81a5f-9034-4055-8835-49b296023cad", "comment": "Malware payload (Dridex)", "value": "2aa57805330f6d0d7473611ca4d46a2455a3eee6a005ff9021d386202034e065", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114105, "uuid": "cc1e9c33-a7b9-436d-b2d3-8c11f70fd135", "comment": "Malware payload (Dridex)", "value": "96fe245d5f53e3b375e52ff01af02cf6ed149b55", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114105, "uuid": "89528c5c-1bf5-40b1-8924-f1d8f7cbd256", "comment": "Malware payload (Dridex)", "value": "28312a104016bf5839bc60429f3eea4a694005d0bea7f74c0dfa2021dfd1bae90f666a41cbd74ec0051894b43ca545b0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114105, "uuid": "081069d8-1a5d-4dd7-9c72-fc3eff62e060", "value": "1114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114105, "uuid": "609c0dc3-e86a-4794-9485-2b76e421c859", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114105, "uuid": "01d049d9-ea73-438f-a98d-68428e8ec4a4", "value": "3072:l3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:lJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114105, "uuid": "45746c5d-edaf-4c76-9e0b-ab5a535731b2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114105, "uuid": "f4fa97f5-0eed-4399-9105-954c6eb72d41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114105, "uuid": "1011c9b9-285d-4cd4-8c42-6f990d92bbbe", "value": "2aa57805330f6d0d7473611ca4d46a2455a3eee6a005ff9021d386202034e065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df54a213-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142716, "uuid": "60431516-50bb-41e0-bb6a-29db2612719d", "comment": "Malware payload", "value": "5c02f09b79a09ca6da182c5f132eabde", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142716, "uuid": "988b70bf-7742-4ff0-bd07-2789cf16f5f2", "comment": "Malware payload", "value": "2ac9ffd3b5b2c7b84db78c3827e6ccacce99d68e88a6c6a27e78744eb57790e6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142716, "uuid": "2f77b66d-264f-4945-9612-62b43906269f", "comment": "Malware payload", "value": "63179992baf30450ca86e705a821f65e9b752646", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142716, "uuid": "9f423f9f-ab64-4ec1-a724-290cbb93ccef", "comment": "Malware payload", "value": "2b5838bc3225556a4c59c8ace36c8878276a44a8c62ef316ad3de115f123b543c9e83d81b68741619a96a90e966b9736", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142716, "uuid": "68a373de-99e7-46b0-8eb2-7f1a7da1cb74", "value": "2214BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142716, "uuid": "13ff34bb-016c-48d9-bf3b-ebf9c873c07f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142716, "uuid": "ad8efa0b-857f-49b8-8d65-08fdf0dd66ca", "value": "3072:p3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:BJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142716, "uuid": "fe776c09-6060-4747-8dd0-a53bfc75e9a8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142716, "uuid": "5a7cca5c-d4b9-4684-bcd6-4825a2fbac53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142716, "uuid": "2a5cda41-c560-4c51-b2d0-2c8cb4d4fd4c", "value": "2ac9ffd3b5b2c7b84db78c3827e6ccacce99d68e88a6c6a27e78744eb57790e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603dc2b4-9142-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617099983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099983, "uuid": "43b38a49-90fb-4fd5-9d6f-4d38c4202013", "comment": "Malware payload (AgentTesla)", "value": "6066e4ccdbc43a4cf75e151bfadcb400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099983, "uuid": "9d6315ea-5d73-42de-9c9a-31ef8af187b4", "comment": "Malware payload (AgentTesla)", "value": "2ae87737bdf6530806f51a691b52efa8919e48d84a49ee756f356bf4556a38e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099983, "uuid": "100e1141-ba50-46d4-b008-8a98dfa008e9", "comment": "Malware payload (AgentTesla)", "value": "3140c11afa1a36f2dfd493c34ceef2256d3ab7bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099983, "uuid": "bd45e649-2f21-4af0-97f7-8f80ccf23517", "comment": "Malware payload (AgentTesla)", "value": "38636c9f2e6043ded3584ec8f53aee2aef9839a94715be8935a8c6fcdba183e3c0e23ce0f7123eeb395873c2d8a8860e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099983, "uuid": "adc1b920-799f-494f-86ce-1d5a7776f0fc", "value": "DCE4B4A870AE805CEEB46634F5B595921FC969321F62FF3F28D66B002C63779F94E410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099983, "uuid": "86b845f5-f2b9-4ec6-8d06-44005e107c5e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099983, "uuid": "aed2713a-643e-41ad-9b89-c66fc50bad3a", "value": "6144:7tTSGs6XLw0Nkcc5Uwtz9c+MM5k6w+qIsK5ReNoRQ0OwzL3EfDWjFOrPa3gYKQm1:xSGsarA5XzqM5k6aIslEr9LYfrPogP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617099983, "uuid": "5df76d71-94c0-4c71-867c-10e0dc24ac1e", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617099983, "uuid": "e7949f26-c047-4eb8-8be3-09126cfb3f81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099983, "uuid": "fcac5048-d53e-4ab8-9655-a8f4c108f311", "value": "Purchase Order 2021 - 00062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f7a59f-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115295, "uuid": "75b8d705-886c-44a2-97d5-66d5a2b4fff3", "comment": "Malware payload (Dridex)", "value": "0e3eee6c0a8e7e0fefb2db2952887811", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115295, "uuid": "d1cf8722-cb02-4a14-bc33-2a0dc7c4c69c", "comment": "Malware payload (Dridex)", "value": "2b030f26583491cd02c4a9cc035583dcdd0bcd6e16181ca97023dab85656c971", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115295, "uuid": "124fb516-4ef6-441c-9e85-bc593e1a1cc7", "comment": "Malware payload (Dridex)", "value": "759aa1f7b2638e35d081454e3fbd7e9e8e09c36a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115295, "uuid": "fee0ff5c-14d4-438c-9f8f-1d9ac2bf83f8", "comment": "Malware payload (Dridex)", "value": "a7779b603c2c2ff13d06d82533dec371fb77acf60b4a05a7a98b259e0911676b160cd4fcffebd98aba596c5d88a14663", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115295, "uuid": "af0c1fd7-4b5f-439c-8c9a-03377800c52a", "value": "0414BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115295, "uuid": "e7633452-94ce-4a9d-897e-0102f32085d0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115295, "uuid": "942cfade-6216-47ca-bc4a-3f68c80e0447", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115295, "uuid": "e06267fe-5c99-4fa6-be15-a12a981abd6d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115295, "uuid": "0a65c5bf-2877-406d-bc1a-016500eb0dfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115295, "uuid": "6beac994-8bcf-4c13-af5b-10b52904928e", "value": "2b030f26583491cd02c4a9cc035583dcdd0bcd6e16181ca97023dab85656c971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f16406-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143820, "uuid": "d61582aa-3251-4887-8ac1-cdb5013beb32", "comment": "Malware payload", "value": "519de75af04d051cc52eb1f2eccbd045", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143820, "uuid": "d29c0687-6d09-4364-bda0-1a19f1527e5a", "comment": "Malware payload", "value": "2b349c24bb3e42628dc51572f52608129453d2d0e445d42f399904580456961b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143820, "uuid": "096bc1a5-5de2-4143-b20d-77010fd9dd1a", "comment": "Malware payload", "value": "1514de5c34410c62c36ffc0ac9e900c5365df2fd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143820, "uuid": "239b09bf-8b9c-48fc-980e-16fe2fb99a84", "comment": "Malware payload", "value": "288383fad593f948a1c0953545b4ae432e31e0860dfba17ac7aa30b60b805aa97883cf56f685a12fc20ade7d1a5e9537", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143820, "uuid": "ca227f34-1d12-4e22-a0fa-83af8f84980d", "value": "D614BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143820, "uuid": "c670f78f-0680-47c3-9529-01028067ea9a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143820, "uuid": "058c9f46-2216-4dc9-9670-93285c66f632", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143820, "uuid": "97bc6c28-ecb3-4149-bd90-353c40df356e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143820, "uuid": "34b12bcb-4db5-4849-8fcc-34a7af0021f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143820, "uuid": "d7e94c69-6ac8-43fd-b47e-9284eb1a5d45", "value": "2b349c24bb3e42628dc51572f52608129453d2d0e445d42f399904580456961b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37565e18-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123107, "uuid": "63dfe078-a867-4734-b661-37643ab4c533", "comment": "Malware payload (IcedID)", "value": "d761b52be07d4ae793f5c2a9b23d22d7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123107, "uuid": "0991a182-11bd-4745-b2fd-9b18f501a056", "comment": "Malware payload (IcedID)", "value": "2b963cb04127c36e0a59f2dd73a5336a2a5d21f0380a47955650343d1ef86bc9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123107, "uuid": "8b0967a1-4214-4330-920c-d7a53b1a1487", "comment": "Malware payload (IcedID)", "value": "675e689b42145aa779908cc2f6586527ad8baad7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123107, "uuid": "e5fa6f12-a61c-400f-b2b6-bb398981522c", "comment": "Malware payload (IcedID)", "value": "8caa29fa5449bb82e5c8262ee2c121668c1d9bd16f8b416b79bdbb08a062e076f2462f6c7f383bd837a9149b684f9296", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123107, "uuid": "c71dd575-49cd-4b51-8cea-1ddda2a12e6b", "value": "41B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123107, "uuid": "2293fb39-05cd-4bd7-a5e6-9cd65101d16d", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123107, "uuid": "02b5b3d4-50eb-4c92-b2f2-dc6dfc673729", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123107, "uuid": "18248b67-31b8-4490-a9c9-87b12067706d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123107, "uuid": "04d3887b-3b9e-43ce-ab45-cee51e72a290", "value": "document-493110808.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6a2597-91b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617148672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148672, "uuid": "e39b474d-7447-4d3b-b16c-cdcdea69a67d", "comment": "Malware payload", "value": "5dc3fe7799b72cf0e00bf4619b98916f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148672, "uuid": "786b06d7-fd0a-4e72-a7e0-71a52e09e0ad", "comment": "Malware payload", "value": "2b9937d850e71932904bf7576b9b20712fc6b41ae3736bd9cc0eac9e5ac72687", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148672, "uuid": "277df5da-29d8-4fd8-8b04-decb9d9efa0d", "comment": "Malware payload", "value": "1a11f6293aac5b463b47f465df9b19d606f238ef", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148672, "uuid": "260f094b-f1e9-4e4a-9391-b83c84aff8f1", "comment": "Malware payload", "value": "d47d3581c783c47b7c06dc2e62a339a17a767d6b2d95994edf695ebe4f7f2571d79ae9b5fe11199302b085f27552b6c3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148672, "uuid": "9abdb117-4364-45c5-93f0-f5c16616a72b", "value": "5714BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148672, "uuid": "8e82ec78-4dc7-4031-9c15-3a051d55b6f4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148672, "uuid": "69af8fdb-ab3a-4659-94cd-5e0f058d14ea", "value": "3072:S3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:WJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617148672, "uuid": "96a32e6c-7ac1-4b37-80ff-9c1702275ceb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617148672, "uuid": "567a2382-46d7-473c-bc42-e3958736375e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148672, "uuid": "0ff650c8-3acf-40ba-915e-5497304eafe9", "value": "2b9937d850e71932904bf7576b9b20712fc6b41ae3736bd9cc0eac9e5ac72687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87aa6616-9185-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617128825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128825, "uuid": "a362d021-b8bf-4c0d-b81b-64ac87967ee8", "comment": "Malware payload", "value": "0bf2d15dbded1460bd3f1303d7067b90", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128825, "uuid": "3268815f-a33d-4bb8-9950-5012bd0f380c", "comment": "Malware payload", "value": "2c0d5413e0169639766b899e0ccbcd670ef790762b7b192c63f819dd6247cef8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128825, "uuid": "4ff98c5c-0d4c-4192-933e-441b851d08dc", "comment": "Malware payload", "value": "41b2a5b5407349714c2224e411a1a55d281caf5a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128825, "uuid": "be1f4b9a-71bd-45e4-9ed5-9046dc6ba828", "comment": "Malware payload", "value": "02a71e65104f0b93175fdfa73ba3fd7277b93701883bd06f24c8416101a864a7f73c2552a2ab13debafb589e27d8bd5c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128825, "uuid": "d90a0082-f789-42a7-a989-a29d31215ebb", "value": "2714BE2DE333D495FFF7CAF41492AA2A8A7B2D40822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128825, "uuid": "b17231da-b7cd-4b7b-8b1b-c15a04a4aa09", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128825, "uuid": "23a0b11c-3503-43ff-9fbf-bb9b6a93c8d9", "value": "3072:H3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:fJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128825, "uuid": "83ce4814-3c7b-4c07-b521-bfb11cfe808b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128825, "uuid": "37147902-30aa-45ac-aa90-bb980845123d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128825, "uuid": "f011a006-0e18-428f-9cbd-4d4d831e2a7f", "value": "2c0d5413e0169639766b899e0ccbcd670ef790762b7b192c63f819dd6247cef8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c71ad7-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120126, "uuid": "04fa595f-6230-4943-87fd-5f1f39b2664b", "comment": "Malware payload (Dridex)", "value": "0710fb4f9b7ff234892f16ac76c4cc8a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120126, "uuid": "0fd7bdc7-1645-4fb3-a972-d84b348d23e6", "comment": "Malware payload (Dridex)", "value": "2c18dd3b276bbc7287da7174d1aa0fd243a3bbe37206bcd0a014f73799680d64", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120126, "uuid": "e2aecfb0-3720-42c8-971b-3a778d1b2298", "comment": "Malware payload (Dridex)", "value": "10437a76b18f708c779272dde524d9a89c2c1403", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120126, "uuid": "39f46eca-f127-4ee0-9d33-8ede517fce23", "comment": "Malware payload (Dridex)", "value": "6b5783f27f159df917ccf62f860e0fb16c771bbb10e9a4276de13d0ebefda5d15beaf55f1477364442d99e4f808c229d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120126, "uuid": "810a04ec-1971-4940-9777-f007aef9efee", "value": "F714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120126, "uuid": "1db2b02b-3c5a-4ad5-9b16-42127478f3d4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120126, "uuid": "96f36337-668b-45c6-836c-07e62bca978f", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120126, "uuid": "38a9ebba-4618-45c8-9f36-7fe6ac0f747f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120126, "uuid": "f72ae2b2-c05a-4825-836c-c6295970556e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120126, "uuid": "5b117a4e-8514-4920-9812-a4550e0fa4fb", "value": "2c18dd3b276bbc7287da7174d1aa0fd243a3bbe37206bcd0a014f73799680d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea5ed261-919c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138869, "uuid": "720b6a5b-a703-438a-be28-522ea22180c3", "comment": "Malware payload", "value": "5ffde40e7e5a6fe2f4eee4e90f75a1bc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138869, "uuid": "88eebc73-b0a7-4b9e-88ef-715f61b3a5f5", "comment": "Malware payload", "value": "2c31913d04c76eae15fbaa9af284d6584569f4d9f8a46d2bfac07a8456dfebaa", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138869, "uuid": "21301aee-7c28-4cd8-8343-ef1ea0a22e44", "comment": "Malware payload", "value": "813a6734af04b6abc5bc43f638f2a75f4aae3ea1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138869, "uuid": "d676990c-6fd5-477b-96f7-60ce55a2d6e3", "comment": "Malware payload", "value": "696c29722e7c6991153c917e4b55e8e951f1fd6b9e2ebdc8394c8cd68376b6671648276858246e6147ec3fd90d85675a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138869, "uuid": "94448ef9-c038-4ffc-ad14-1e17b044d05e", "value": "2014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138869, "uuid": "f2d0ce44-0237-4761-a437-0c6eee29d4dd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138869, "uuid": "e170eef8-445d-4fac-9f96-a4ab2ae55b8f", "value": "3072:I3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:sJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138869, "uuid": "f70440c9-53a8-412a-829c-56dc4c614779", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138869, "uuid": "fd38e5c9-1b18-4ff2-9cf9-c6fcc5ecda96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138869, "uuid": "917a2f7a-9ed1-43c0-a71f-8e4f3c0644fc", "value": "2c31913d04c76eae15fbaa9af284d6584569f4d9f8a46d2bfac07a8456dfebaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b61d003-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143703, "uuid": "b2863e16-0b0b-45ad-8176-f3846036a9a5", "comment": "Malware payload", "value": "c306b89719a45e98918a15392c1f2def", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143703, "uuid": "ac264f4f-4499-4e35-a98a-f8df5e60e5d9", "comment": "Malware payload", "value": "2c67a686deac50958c92eaa99fac39b20f7eb7f091eef66487c5faef92740f19", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143703, "uuid": "e4da6c86-0c44-4b5c-a601-f9f9f57b41cc", "comment": "Malware payload", "value": "1359415a8592c68cb3ecf49276b00044e3641cd3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143703, "uuid": "82c6eeb5-1cb9-4507-92e6-40f38fc402fb", "comment": "Malware payload", "value": "4f83c0458e5c1a535320dd9a59dd96e4a9f21c04f02eaca456aba611290fe90138303f839d9935c668bb85172edf8f48", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143703, "uuid": "41871340-c1b8-46b6-a3a1-44b54bce0090", "value": "DC14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143703, "uuid": "54475969-4ad4-4666-b83f-cbde79b7360a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143703, "uuid": "48a7b28b-c4d1-4006-b5c2-2c8bdb9154d1", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143703, "uuid": "631a0d91-94de-4442-85a2-68c3702fc090", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143703, "uuid": "b906a8a1-6469-4ffa-9dbf-8ef39950456d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143703, "uuid": "0a051aac-ba84-4295-bbad-740520e0348e", "value": "2c67a686deac50958c92eaa99fac39b20f7eb7f091eef66487c5faef92740f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "022aacbe-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131608, "uuid": "451900fd-04c4-44aa-afae-ce0ce7b5d9f5", "comment": "Malware payload", "value": "7d8d15e0b2c8b4ade93e0b75411a3af9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131608, "uuid": "d9751d64-3273-48f3-80d9-2dea08f87194", "comment": "Malware payload", "value": "2c8c260c85238d6d6ec4d0a7cd7394f0e20f819d7b1b0e3428bbcf94f7d4639e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131608, "uuid": "42a29ae3-98ee-4293-8462-fe8fffaa0a45", "comment": "Malware payload", "value": "b4e28e9716cbf956f003111172254bc3a1387e0d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131608, "uuid": "1d953fd3-43b9-4d60-9c43-3479ece62dfb", "comment": "Malware payload", "value": "c2996eb16140c411c0de564298acdc4ccab9b5f82a865c320cc1834db8bd791f3804689dbeca5ccae7857edb4dd64fc8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131608, "uuid": "5544ac5d-8034-4d5e-a3f7-e416914015d8", "value": "DA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131608, "uuid": "14599c5c-89f2-46ff-9574-c1dac565d57f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131608, "uuid": "8b16f5a8-e5f3-42f3-9fee-65bbd89afef7", "value": "3072:h3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:5Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131608, "uuid": "f06cbfcb-d0db-46b5-8b71-ada084a2fe79", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131608, "uuid": "fd485a2d-bbd4-4c53-b38c-28884b571de6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131608, "uuid": "03b2550f-0291-48d9-9d71-fe3ca0704001", "value": "2c8c260c85238d6d6ec4d0a7cd7394f0e20f819d7b1b0e3428bbcf94f7d4639e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdd83b9-9147-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617102318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102318, "uuid": "323f76f5-ffe4-43a2-9ba8-a28a698f28e5", "comment": "Malware payload (Loki)", "value": "de41b386f1e2470d2e8208532e79d5da", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102318, "uuid": "2b19973a-f533-47cf-abcc-f98578674b3a", "comment": "Malware payload (Loki)", "value": "2c922f97057ec58c2d15f98b1d24ae0c7583560b0bbef0cbc1e75a885b9a9673", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102318, "uuid": "6d38ba66-3213-4a85-86ec-2b08f9db3105", "comment": "Malware payload (Loki)", "value": "461ed2e487eff68ea254c151fbb5ae86cfc64345", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102318, "uuid": "aab04cb8-a18e-40e1-86fd-5fabc365bf86", "comment": "Malware payload (Loki)", "value": "62bf5f31d3397d9874465e24fff8dbb8cd8005a623970436ad8a8d6497d7a421000cb347ff2bafa5ea4dbe8cb15f0a67", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102318, "uuid": "56d34525-ed1b-43ab-9f00-9ec039bb29dd", "value": "553422D366402B5873762CF49B7F7DB62848AD15E02CC604B7B147469C61A3FE2E398A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102318, "uuid": "11b1a03d-5c85-4b6f-bd9c-a90b06b9c0ce", "value": "6144:SScPhG4aRJXIqMRW+uWjmjAQ4aoYpei5hP8wxmjU4T:yjmJsRjuFb4aoYpei5Gwxmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102318, "uuid": "eb8b6adb-f3b9-4b37-aba5-4adfc572992f", "value": 250614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102318, "uuid": "e50434a7-bc93-45ec-ba42-eaeecf474ee4", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102318, "uuid": "6d00e537-6cf6-4130-85bf-ebed0118370c", "value": "Order_30.3.22.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9456d191-91a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142161, "uuid": "ddad34ed-526d-45ee-9acd-a6f2af07c89f", "comment": "Malware payload", "value": "34a227d9cf496a27582138459cd60079", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142161, "uuid": "4abf1bbb-0cf9-452d-97fe-05ac3592a227", "comment": "Malware payload", "value": "2cbe943962b34f673ad84b0ded51c0a7cfa1810fe8e83cb3ca36fc0ba330ca7e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142161, "uuid": "8cd66b43-e471-48e4-aee4-5188d6fd983a", "comment": "Malware payload", "value": "0031c8a170704d41ddfb84bbde8f5a7dd9f56d4f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142161, "uuid": "a63eaf73-a2f3-49d3-b89c-45b7adb99fea", "comment": "Malware payload", "value": "db17b792ae307b801375866181bbfbf3f56d58bf59e248d0252be75507895223db1d12a926a70ab478766519507cdee6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142161, "uuid": "f9a5c18d-d5bf-4544-9cc8-e299e5687aa3", "value": "A014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142161, "uuid": "eba895a3-35c9-4366-9f4e-cf2328c95519", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142161, "uuid": "20e0e236-9408-4f2f-893e-636537a7131a", "value": "3072:a3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:eJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142161, "uuid": "d6b49f16-8309-4a28-bc76-983e5398ec5f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142161, "uuid": "bd2bde31-803e-48d5-b1d2-613e9f0934d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142161, "uuid": "67111974-7f1d-4bee-be00-3e2ef695073f", "value": "2cbe943962b34f673ad84b0ded51c0a7cfa1810fe8e83cb3ca36fc0ba330ca7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8cc2e0-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114392, "uuid": "70d0f6ad-0b20-4f23-ad64-58e21e4ebd7b", "comment": "Malware payload (Dridex)", "value": "750a76c1ba3b68ff463e9b6207d35894", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114392, "uuid": "5b9563c8-af54-4927-b007-02bfbe60cbfe", "comment": "Malware payload (Dridex)", "value": "2ceb4c437a1a190713d1770e4fe6986b6bf0d7fe28ad7a94ca188f03595f8ad1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114392, "uuid": "62fcc3f7-0ef5-4f7e-a101-5d991779a333", "comment": "Malware payload (Dridex)", "value": "91c44a514a09fe6ed12a6bdc6a491ad61f319382", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114392, "uuid": "ba1b1f09-3940-4c19-84df-36258f50be36", "comment": "Malware payload (Dridex)", "value": "d9e73a257605cd5ea28c4070b4c982a212fb63573aa66bddda99258ac629a23ca2777b8d4cf9a43ef78070e52b072dcf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114392, "uuid": "60b84659-b011-4306-8203-5280468520f3", "value": "8914BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114392, "uuid": "a1cf5d72-eb0e-4762-9a3e-0def32cdf464", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114392, "uuid": "c3a37b02-ef3d-4bdd-bd63-8144c4a2d972", "value": "3072:j3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:DJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114392, "uuid": "965d6957-f1ba-4622-ada1-b931588acadb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114392, "uuid": "131e8cb0-2525-4b4f-8680-7bc679b18c49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114392, "uuid": "8deed87a-adcf-43c7-ad6a-8a022f02e798", "value": "2ceb4c437a1a190713d1770e4fe6986b6bf0d7fe28ad7a94ca188f03595f8ad1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b595060-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121476, "uuid": "33ff9723-9457-42ee-8c99-3bbf519eaad1", "comment": "Malware payload (Dridex)", "value": "742c37ab2aa2dd4e1f52ddf47cec2ba8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121476, "uuid": "824ad1ba-2beb-49c7-911f-ad77aa8213eb", "comment": "Malware payload (Dridex)", "value": "2d18ec27b938e965a2ea6172a9a3565b3ff3eca2924874e37b9bb8aeae96461a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121476, "uuid": "855d14d7-02b8-47ca-a627-434195609b65", "comment": "Malware payload (Dridex)", "value": "61204728d90928b298217c0f0ecb50e907960d81", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121476, "uuid": "2b0ae2ce-85a7-49f8-ad0f-7db628a2e76f", "comment": "Malware payload (Dridex)", "value": "76491ae71a488bec9acbb763fd53fc2ee4efe7862cf81e503b128d123ca797b8e0083ef84685bb492d83ed3adf4b6fe5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121476, "uuid": "45dd3781-049e-473a-b941-d9bff9c17ac0", "value": "2D14AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121476, "uuid": "c6f95999-5bbe-4508-b484-42b90da98e34", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121476, "uuid": "c855e589-fb80-4d12-97a2-b8a64f879133", "value": "3072:C1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:6i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121476, "uuid": "ab743564-e317-461e-886d-549f5310e2db", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121476, "uuid": "ce7c8da5-69f9-43c3-be37-9333a20faf03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121476, "uuid": "ad6c2ab1-79f9-491b-b2fb-2e1adc997dfb", "value": "2d18ec27b938e965a2ea6172a9a3565b3ff3eca2924874e37b9bb8aeae96461a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a704024-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114120, "uuid": "ca721791-21e6-4b02-860e-a935ea7bafe6", "comment": "Malware payload (Dridex)", "value": "b6e285ac19078507306453582abf63fd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114120, "uuid": "4bdd459a-d513-4cb1-bcdc-2c091a048823", "comment": "Malware payload (Dridex)", "value": "2db53a4e6bd2098a5381fa943f249cd0e64f512a9a5037894f4ad53eac01ed95", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114120, "uuid": "ecd93188-e574-464d-a717-4d8608dfb976", "comment": "Malware payload (Dridex)", "value": "3d5ff02f828d008f6a5710cd4b5fb7b4a85a14a1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114120, "uuid": "45621604-90ce-49d5-886e-01f83020c73c", "comment": "Malware payload (Dridex)", "value": "ed33e7fa4137444b101d6d4819b69812cc611bddea834241739fa62d9e0447d3fbe8ada7d9cec442ef7417847d121dd7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114120, "uuid": "a8ff4839-d6d8-4c6c-821c-2843d0513114", "value": "1414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114120, "uuid": "152c6244-5bce-43d6-81ea-7bbe7117e207", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114120, "uuid": "dea6098e-77fd-4599-8435-bfec98059ad2", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114120, "uuid": "c100b5ef-ca00-4832-827c-7054d856fe6d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114120, "uuid": "2c31ff29-0129-44bc-89ce-01d8ed5d682a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114120, "uuid": "c594c1e9-6439-48b3-ab97-59551887e725", "value": "2db53a4e6bd2098a5381fa943f249cd0e64f512a9a5037894f4ad53eac01ed95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fec4b38-914c-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617104143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104143, "uuid": "676dbcd2-3f38-4de0-bd4b-be5d8d92f9b9", "comment": "Malware payload (ArkeiStealer)", "value": "e578c917f3478091a94ea5e7c47e7739", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104143, "uuid": "ef761bd4-b26a-46b7-800d-5d3093eeb936", "comment": "Malware payload (ArkeiStealer)", "value": "2df27f1a3505dbd0995188d49c253f5bc53c0e994954c4143da6d13efbba126e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104143, "uuid": "e9c48720-d184-409b-8893-8bcebcbc0ffe", "comment": "Malware payload (ArkeiStealer)", "value": "22ac946afef96396f90ea11eeb06f6c57fa378de", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104143, "uuid": "e25254ac-64c6-4bda-a945-1e0450bc0ae2", "comment": "Malware payload (ArkeiStealer)", "value": "6c58ecff099dac7f14397aa03155d1a34a99d23423df4b04bfdacd9403e1673d0b8c932c23927f486356f12a2ce279f5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104143, "uuid": "39974a90-6f1b-4a5f-86f6-fcd91c50b470", "value": "FDF401A03998DF95E62C53FA5064680057F5E3EA1013EF4D8ED8E4EE282AF4C4ED4B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104143, "uuid": "e321f905-8349-4ad5-a100-51505b5a7624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104143, "uuid": "f953322b-2680-4683-a5a4-579d7a9b1888", "value": "12288:mXT33YgEtEb4ON0kcE5OFVXKEVjVAktew6Yqg7Y8SpvR+Cm/LkvivwFV+PVyve:mXjhEEk85OFVaEBVzQw7XS6NDkKveuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617104143, "uuid": "d5305319-d43d-4152-ae13-e45c872e9028", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617104143, "uuid": "00ee5bfb-1c55-4a13-9b8a-35ed8862b533", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104143, "uuid": "8f2ae844-dd11-43da-9062-ffd2fc455a62", "value": "2df27f1a3505dbd0995188d49c253f5bc53c0e994954c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce62f63-9187-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129613, "uuid": "731356dc-1533-407f-bdf8-d3322dd55e37", "comment": "Malware payload", "value": "a14ed404e47f8f84c3195e43b160a6fd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129613, "uuid": "a44bb419-4698-4522-bf42-5fd2a6e25e0f", "comment": "Malware payload", "value": "2e02407ba91bc2396f4b8d088277b7ce94fe5909d5c00acd22019508d8d82238", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129613, "uuid": "658da8ce-3615-43a4-ab50-c741df0b2630", "comment": "Malware payload", "value": "3d61593c9ea1495c6d36259ab366f88db544d219", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129613, "uuid": "861a49c9-feda-465f-a5e4-e79ad08d8bb2", "comment": "Malware payload", "value": "94dd35e8878fd3151b0e88cd78996dea53c4b3f2e724e76574e9f1f1e0de463cb72300b20917f87a895a7577c95c8197", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129613, "uuid": "956524aa-ecf1-4f30-9dbf-c1d63c2ae5f1", "value": "2D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129613, "uuid": "663126e7-38f2-4de0-a54b-21822a86b4a8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129613, "uuid": "9fba3bd7-99c7-46b9-9215-69d2358d6a35", "value": "3072:A3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:EJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129613, "uuid": "b7127167-4df1-4d32-8e6d-4757b7c3d9bf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129613, "uuid": "dc8ab042-4caf-4a66-b293-6082d1095a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129613, "uuid": "0c2d2a43-ed98-4759-8c04-044d3503b647", "value": "2e02407ba91bc2396f4b8d088277b7ce94fe5909d5c00acd22019508d8d82238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f1137d-916a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Hancitor)", "timestamp": 1617117169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117169, "uuid": "e5345417-e31e-4733-ac18-c8b9ad6f4323", "comment": "Malware payload (Hancitor)", "value": "2562937a5544307932de1a4fd4ebcd1f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117169, "uuid": "340a3472-c80c-4eee-ac2b-8f1e17a11a38", "comment": "Malware payload (Hancitor)", "value": "2e1d1aa97955e5a633b0a9f084db2763153ed299016fefd249b137b36a6444bc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117169, "uuid": "7e8c3c13-54eb-46ec-ad9d-94ca339e696a", "comment": "Malware payload (Hancitor)", "value": "09622551955456b6f7dc2f93f1d15360451563e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117169, "uuid": "9ebcd592-079a-4ab6-89c9-40edaa8b1dd9", "comment": "Malware payload (Hancitor)", "value": "45a9ae4091edb75162828841399c058ddfe6a8562fbd0c21218284e756859b4c8eb436d90865cc2aa4e21e72751c588e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117169, "uuid": "4e7ed1f9-b4a9-41a3-9d79-b6e344ec25ff", "value": "EE747D00B642E036F8F301B6CEFA866D566CA991076458EB63CC287D8F77AD17931727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117169, "uuid": "babe2bcc-b940-4f49-99ca-b281a110cc51", "value": "6bd3e1c53f303c94b8e7d4acd85d76b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117169, "uuid": "07305445-6bbd-46ef-b480-d2bd213e6847", "value": "6144:2twE4YbC0qq5AJBX+1kAcYlAkueHHQ2xTb5lYQAOEJrBmMlcz:2twFYbC0qq5AJBXSkCueHHQov5lVeJEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117169, "uuid": "2071006c-2dbc-47c2-863a-ebb2c475e46f", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117169, "uuid": "dce1ad41-2790-4e6e-97ca-7fb07e35390e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117169, "uuid": "32ad2c40-6052-433b-93e2-268bcb12ece1", "value": "msals.pumpl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2b098a-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114099, "uuid": "9448f45b-9759-4f02-b5ad-651115d980a2", "comment": "Malware payload (Dridex)", "value": "4f4d9fcc9a318b719d210dbb07c8af1d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114099, "uuid": "adf3d211-5d93-4662-923e-74b46f99ed45", "comment": "Malware payload (Dridex)", "value": "2e4c8092ff7fdb2fe5c6bbf8da205c8e431c110e2d331b78334a7ff9ee8ca9b6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114099, "uuid": "a95fdbe4-60e1-4f51-ba06-2de0f68febc3", "comment": "Malware payload (Dridex)", "value": "24b58a3865837fd57f1d4a4e16233c7c7ed2021b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114099, "uuid": "3c396dcc-f52f-4f95-93e9-ab61b240b730", "comment": "Malware payload (Dridex)", "value": "7bccd48c3e5648b51596d82ed21612a55203fc2eda69711bb8b382fd40bb4f8a6825a0731b7ddf42c262571f91d184d6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114099, "uuid": "2d2a89a9-162b-4ac9-8a33-33230b55453e", "value": "2914BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114099, "uuid": "24de5034-b546-42c5-bdcf-b6cc140e00b6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114099, "uuid": "e10b6346-da0b-40e8-90db-016369d09712", "value": "3072:x3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:pJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114099, "uuid": "dfe602ef-81e3-4e8c-b0d9-dc7889b2dd0f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114099, "uuid": "7d06a722-2e33-45e6-8099-4e727723cace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114099, "uuid": "804b0230-438f-483a-a48f-a8eaaba619c2", "value": "2e4c8092ff7fdb2fe5c6bbf8da205c8e431c110e2d331b78334a7ff9ee8ca9b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d84f17-91a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144064, "uuid": "3595ade0-dbcb-4e40-be9d-cd0f48bae053", "comment": "Malware payload", "value": "54d70fe922c54f40f0a72aa9e6f8feea", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144064, "uuid": "5b4c1b3a-8751-4d14-8940-90195f7086e0", "comment": "Malware payload", "value": "2e5d719d3716f2e9d10bef6d791017f8d065cb4c7152c7a544c7028d7a8ace77", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144064, "uuid": "87c34147-3c8e-4f7a-ad4e-eb15bb6ac586", "comment": "Malware payload", "value": "61abadf29e26d91595c286b1b35b5a45f9fa46a9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144064, "uuid": "8eb86c2a-f31a-402c-bbe2-02944421867f", "comment": "Malware payload", "value": "f86fa013cccf4c8381ea03a95a4b031438dfa0904831f36223600a8485dfe53bafb973489665c8dc4f406f4b753f663a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144064, "uuid": "30deeb61-19ce-44a2-9d41-cf4cc6b66167", "value": "CC14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144064, "uuid": "eb726382-1a2c-4576-80a0-542abad78908", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144064, "uuid": "4229c408-9bca-469f-8f78-73f8479ead7f", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144064, "uuid": "aba4978c-2479-4fc0-b6d2-4992ca887587", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144064, "uuid": "694e253c-4f8c-48b5-b185-cb5c9c1f4696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144064, "uuid": "bfbb3954-674e-4328-b50a-11678e9d0bd0", "value": "2e5d719d3716f2e9d10bef6d791017f8d065cb4c7152c7a544c7028d7a8ace77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc1c7e0-9117-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617081537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081537, "uuid": "f4bd46f5-6461-4a02-ab9b-3e7224d62529", "comment": "Malware payload (AgentTesla)", "value": "d86dd33a02a355f1a26d8de11c1a685f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081537, "uuid": "b1e116df-090f-43be-9c01-71c571ba4e4c", "comment": "Malware payload (AgentTesla)", "value": "2ed9419745b241cf13d90594e91ea9c8a5701181e1b2c2e3ccdbd91f5b8e9ed8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081537, "uuid": "5ffe77c4-be1d-47d4-907e-d7f0648a1560", "comment": "Malware payload (AgentTesla)", "value": "4446a8afb9d1203492397b3165d250b76cd214e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081537, "uuid": "b0d6c9f2-51f2-445d-b4a5-7b3cbf283f00", "comment": "Malware payload (AgentTesla)", "value": "8f98fabc745e520fe69ec12943288075ebe52eb008e91447dc4646469787683c655785af82d2089a34383b3d16d51278", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081537, "uuid": "d077a126-d080-4114-b1b3-1ec7c510eba3", "value": "3EE4918C5D9EC1E6E6354BB842C9C4EB46EB5EF30F22C879B9C687C7E020746E506536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081537, "uuid": "447c4d53-8143-42ca-bd69-b66d094c918a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081537, "uuid": "9b6a5e15-c946-42ee-ad86-c802dc2d7795", "value": "12288:zzexD1DDypQ3tIwXd28zv0PdDNApbboVrJ8:zzexD1DDyW6gd2sMPf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617081537, "uuid": "cbd4cc4c-5c83-467d-9562-23f48b232e75", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617081537, "uuid": "58f75838-4a7f-4b87-8a5e-364ac65b4345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081537, "uuid": "11e21895-eb21-45f5-8f6d-783330a590c4", "value": "AS897635632.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30f2851-90f6-11eb-abe1-42010a9c0039", "comment": "Malware payload (Cybergate)", "timestamp": 1617067561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067561, "uuid": "01aa1b2f-d03a-42ed-8f16-7896c51a92de", "comment": "Malware payload (Cybergate)", "value": "f7b9980b8346b59f0b012e07f0d2207c", "object_relation": "md5", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067561, "uuid": "9c896cd8-d9a8-4933-9660-144870eea8f3", "comment": "Malware payload (Cybergate)", "value": "2edc1d26a755fce3c36d97ee664473a24c09f653c38792118db34196cd638d06", "object_relation": "sha256", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067561, "uuid": "87cb6ae4-6ec5-4cd8-b78a-aaaf5405e896", "comment": "Malware payload (Cybergate)", "value": "eaf80f0dcaea152d4bd81eeaa3ff8d31330acd01", "object_relation": "sha1", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617067561, "uuid": "1e099548-3715-407e-8932-feccfedc203b", "comment": "Malware payload (Cybergate)", "value": "bef4be3b9aa2c1e43f1ac16e30d6100cc83b76b701abd642ad251fa8a9d8ec01be97a28a12c51dc5276786d9ef1f5a7f", "object_relation": "sha3-384", "Tag": [ { "name": "CyberGate", "colour": "#7058BE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067561, "uuid": "9eadd6f9-c51c-4b2d-94c8-8392bdee0bb2", "value": "065412F2F85198F6EBA18EFC5D38D3C5F52D7A296D23009769BD1E88C62C113560E1A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067561, "uuid": "ac456a52-449d-466e-8521-4c25a1ec1fc1", "value": "a1ca9f77a798c9b4f0e454a9da75459d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067561, "uuid": "72a262fb-9526-493a-9b13-de45b61f7d89", "value": "6144:/yuMwiLdfF2m7mrUsqWBn837FNldObO3k1jV:quMwk2m77sZB07FxObO32p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617067561, "uuid": "73877807-7d8e-4b4e-a2f5-db8ac45a13fc", "value": 283681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617067561, "uuid": "4d9755fd-f59f-46bd-badf-1095722a4731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617067561, "uuid": "a28a8d7c-40bf-4e78-8611-4211d2c19385", "value": "F7B9980B8346B59F0B012E07F0D2207C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885338c9-91a2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617141282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141282, "uuid": "d3e33551-1d0b-4309-8b62-ef6b0477d66d", "comment": "Malware payload", "value": "e37e9f124aa3aa6f92601993b7fce00d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141282, "uuid": "6207c8ad-d9f7-45c7-85b8-d6b763d04451", "comment": "Malware payload", "value": "2f09d1e97098f983fc65752b1f71df3be82826cf45d95fa82085118e0585cbc0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141282, "uuid": "2289872f-2637-4087-97a8-97a648943d9d", "comment": "Malware payload", "value": "70ddf67a217c64b0c216b69ba0c65bca091f9020", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141282, "uuid": "9e6dc294-6e49-462b-b750-518d9d332802", "comment": "Malware payload", "value": "e276b2872c6ba8332315d78a3921298aab253437a3bd4491f8f17079ba83b07b862814c58f5379f6a84131c1fc739add", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141282, "uuid": "42a3b30c-907b-4cc1-b963-0058f6aeece1", "value": "3214BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141282, "uuid": "0eb0658b-275c-4a2a-9f9e-0f560e338fd0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141282, "uuid": "71ad8c4a-1b59-44c5-8336-e074b02ba428", "value": "3072:r3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:rJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617141282, "uuid": "63f246b3-ecfd-47b2-96e8-112889cabdbd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617141282, "uuid": "e9639fea-5833-4b4d-9a48-e523c0a90355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141282, "uuid": "b3b247e2-5883-485f-a843-d1a27d706c09", "value": "2f09d1e97098f983fc65752b1f71df3be82826cf45d95fa82085118e0585cbc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861531ce-9107-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617074706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074706, "uuid": "d43a8e6a-20b0-466c-8aff-b715a7b8bd50", "comment": "Malware payload (ZLoader)", "value": "d1f541277dc46fb22cd09e2bdbd19f66", "object_relation": "md5", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074706, "uuid": "29820c91-decd-4ad2-a0b0-13e61b05028e", "comment": "Malware payload (ZLoader)", "value": "2f2a993289a24379089ca6e910f83b1b8efb79cb5088c4e77728ca3f90889558", "object_relation": "sha256", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074706, "uuid": "f689ab52-afe4-4c89-b5f9-c66056be244d", "comment": "Malware payload (ZLoader)", "value": "6ceb58266a2167dfca1eb553b8846d347b883b8d", "object_relation": "sha1", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074706, "uuid": "88447bef-1959-4a41-ba8c-710c3038b130", "comment": "Malware payload (ZLoader)", "value": "26c8237f4c67ccaa282eb135a080ddb526cac13d7ed46fb9fda36e4d9548ed6d357c7dbb99eeddadfc34994b2999585a", "object_relation": "sha3-384", "Tag": [ { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074706, "uuid": "a33c06f6-071b-41a9-8765-f27ab9d0edb5", "value": "4892D133F620EA5DC5B6477FA20C01E6730F10A11E5B74A93651C27EA355F3F23A62A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074706, "uuid": "cd6ee0b5-839b-4b34-984a-991edb6fd08d", "value": "384:Z1lNaxAFpyFGjbs7lClyitc2YL+Ww58nM7wH+p+kUlM9zTAac:blNaxJjlClmLL+qZep+kxob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074706, "uuid": "5cf8e43f-2863-4c25-a0b4-5d6f2159aa20", "value": 20591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074706, "uuid": "6c45bef0-01c3-4a26-a7b1-2b3f92915b44", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074706, "uuid": "48c32870-a3d1-4377-a0da-021f3886d318", "value": "hmm.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe46763-914a-11eb-abe1-42010a9c0039", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1617103284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103284, "uuid": "8bb62251-606c-42d9-bf0d-5042051a7285", "comment": "Malware payload (RaccoonStealer)", "value": "b57244a20b1130978e1f49045ae571a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103284, "uuid": "9b65238c-a7c8-41ac-9cc9-a313ea04c711", "comment": "Malware payload (RaccoonStealer)", "value": "2f4dc31023ec39356b3aa220863cba0ac8b25770641423bccf79ee2b10d77278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103284, "uuid": "83a9ad6d-e1aa-47a5-b07f-9e771f7ffc1f", "comment": "Malware payload (RaccoonStealer)", "value": "7872ad8670696453d1b95e0193839167fe5e727f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103284, "uuid": "f641ce0e-2875-4978-b637-88081854e9f0", "comment": "Malware payload (RaccoonStealer)", "value": "68873fef4bd1cf43eb789e3200f852221d9d147198162c67e223835b338d6def6c744e1c23e3ed9532efb435edffee87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103284, "uuid": "3f61dd2a-3eb2-4530-b0ac-2ee9bf23cb52", "value": "AB3512F03A94C794F62C97FAA525540007B9F3EA1153CB8C8D98E4EE295EF8D1DC4A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103284, "uuid": "5b2e555a-72a5-4013-ae08-00fb576df018", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103284, "uuid": "b8b1008e-579c-4f6b-92e3-19d0dc7f3afe", "value": "24576:wrNX8v7dYpALWlQvz+/6xTkBFm61p/M1JocXzQPHQvkpI0WH:wrWp2ALW6+/eTkhS1OKzQPwvYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617103284, "uuid": "0c08d52d-80a4-420e-9109-f8473884c0c8", "value": 1109504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617103284, "uuid": "34864b86-a688-46c4-a861-487352d5c4bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103284, "uuid": "6c35e7b5-fcb9-4586-a165-71e22cad7ffc", "value": "b57244a20b1130978e1f49045ae571a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79d9bc3-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617106572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106572, "uuid": "cbd75e25-4ce0-409b-9c20-6cdd9b51e2b1", "comment": "Malware payload", "value": "b1634a36ec780d3a37abf27171b39a09", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106572, "uuid": "5840f997-1cbb-408d-909f-3680853fb0a3", "comment": "Malware payload", "value": "2f88d57c9e91cc904c83fbdc97ffb2439cc88a569e77c1ddf14131f806c1fae5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106572, "uuid": "6a758df0-be0a-4961-b716-3be5c0b85848", "comment": "Malware payload", "value": "58ce73f2781a99c0d05a235bd8ebc0fa8daee421", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106572, "uuid": "03152541-25dd-4a4f-ab4a-768b7868f683", "comment": "Malware payload", "value": "86d830ff80e8875057bc9f775fa401b4ad36f3d2b905c747cfc1eb001047a2bbfbf66938cc046631347e8a2300abc4f4", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "lz", "colour": "#6CE4E4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106572, "uuid": "6f5876c1-f544-4bb1-a3ca-b44e951bdfdc", "value": "A2E423C1B86A7F96444533841FD7237A9DF7BA327424A30EF27484B4F8F512C7928A99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106572, "uuid": "ef507675-1be7-4374-9eee-47f25d109b65", "value": "12288:90Z2ULEE5qqWPUE9BxlqhFcH3uLQrVJnY1fHMhRfYpJr+4J9TBrPEtlDMDrHXEKT:90ZxfEzQQRJnu+YDrHJNZ8PMPHXEKoAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106572, "uuid": "7dc1a966-78e4-466a-98e9-4c6f7c080af4", "value": 702137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106572, "uuid": "f3837d8a-ce1b-4b6d-b7c6-f82b502d9502", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106572, "uuid": "5d7b8543-b328-48d0-95ef-16ded4d83f92", "value": "DHL DELIVERY NOTE 2021003982721.LZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d0ec30-9106-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617074321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074321, "uuid": "d568b18d-6b9c-4380-b70e-dabd85c6843a", "comment": "Malware payload (Dridex)", "value": "5ab62455a6925f0e8adcdb4eaa9e0000", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074321, "uuid": "030a45e8-5d43-49d0-999f-1faf095c2f33", "comment": "Malware payload (Dridex)", "value": "2f95344e5e43861fd9d4d890dd49b7a1401e3d98c7308b5f45702c2c9e45d56a", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074321, "uuid": "d20fa103-6e46-431e-a914-22420edf3f02", "comment": "Malware payload (Dridex)", "value": "30e1d6a556a05a6709caa416f9871353183f54f7", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074321, "uuid": "359fbafa-60e5-43c5-ab04-8bce760ae75e", "comment": "Malware payload (Dridex)", "value": "79266d6b7392523726e1746cbbc93ef0c5e4b8aebe6065e374b9e4a2f29fa24adc2ec5570f4763af413163dcf160441b", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074321, "uuid": "d68a1e87-473a-43bd-835c-c8a1d3f2545b", "value": "9EC4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074321, "uuid": "a1385774-00fd-4d42-a589-a0e78b8b3ddc", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074321, "uuid": "1571450a-1842-49cf-b21f-78137e350d80", "value": "6144:9GiMOQpsduhD3AZHC/uNbExd+4UuwT1b0717WLmw6Xg6DqaIDnnlvghH5la:wVhDQZHC/uNY2/TRm8LYQOQlY7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074321, "uuid": "d09017dc-4c8f-46c7-8456-df6d2857aa31", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074321, "uuid": "5ab9d843-e7f6-4091-84a6-f18d430f6353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074321, "uuid": "792a3dad-36c1-4aa6-8c86-32bc915d0593", "value": "2f95344e5e43861fd9d4d890dd49b7a1401e3d98c7308b5f45702c2c9e45d56a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b8442a-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120262, "uuid": "d3f5005d-200b-4c95-92d3-354fbcabcc0c", "comment": "Malware payload (Dridex)", "value": "73f9b36cb00b57358b703a3efb9e26eb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120262, "uuid": "d7956a9f-421d-410f-b2bd-7e6be60206c1", "comment": "Malware payload (Dridex)", "value": "2fa8bf2b966b100f1709b431d49e44a52a454b0845d2716844c98f9f75f0ad99", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120262, "uuid": "a07f6cc7-ff43-48f6-9a08-160d667a0dea", "comment": "Malware payload (Dridex)", "value": "b2ee2a46887b699967240a87d81280a15ad7da24", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120262, "uuid": "bfe18a03-dedd-479b-9297-40a4ac2d695a", "comment": "Malware payload (Dridex)", "value": "3c0817f3716405528250eff904ecc84a3896c2e4eb6cfb6919cf6fa7e668fe82b445e07b2d50c072a2eff131f7e3d99f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120262, "uuid": "61ad66d1-0499-4353-8d1b-daec963012b5", "value": "4A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120262, "uuid": "d018b3ab-5248-47bb-900e-52905e860cf6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120262, "uuid": "b0afaaa5-a26e-4fb0-8bde-8a7eb5156713", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120262, "uuid": "ab84917b-5fa5-47e6-b024-55a8a313a12d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120262, "uuid": "fb6c7727-d2bc-40b5-bd41-4e16ede756b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120262, "uuid": "8212a386-f130-42aa-b87c-b0afe2fb2194", "value": "2fa8bf2b966b100f1709b431d49e44a52a454b0845d2716844c98f9f75f0ad99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb47f0f-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143838, "uuid": "6dd2b25c-9268-4997-ba68-bfa8877e43ac", "comment": "Malware payload", "value": "690643fc73687919677ebc91423ccfc0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143838, "uuid": "145cf4b2-e690-4c8b-b862-d6f485cf7439", "comment": "Malware payload", "value": "2fc07bf8f800b68cb4feb7cc76c4080b6ad6538978ba12e38d1dbec3b8f553b4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143838, "uuid": "8a9711b5-73cd-4ca4-81e8-1de0c2d5de6f", "comment": "Malware payload", "value": "5f39cc43409b882870ae2a41aef8e485918b0f2f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143838, "uuid": "2959a9ec-5a09-45a8-a6a8-eb432a2f63de", "comment": "Malware payload", "value": "02008ccd4fda715d6aa638e542d8afe99379cb6adc19687e581ac751516d1bfb156d687c03eb8a6877d4d2b423e36d6c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143838, "uuid": "09cd6bc7-1b6a-4c9d-bbe6-45ed28ade236", "value": "0E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143838, "uuid": "26c78520-9e5a-4246-9ce3-3a43245ed6f8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143838, "uuid": "4105fb8f-1a82-40e8-a29d-0dfce6536909", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143838, "uuid": "32614c8d-b507-4e52-b925-16be410101da", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143838, "uuid": "b7812621-677a-4d59-a2ad-a620a7ec3544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143838, "uuid": "8665563f-2433-4ac6-907a-cc96aac8614a", "value": "2fc07bf8f800b68cb4feb7cc76c4080b6ad6538978ba12e38d1dbec3b8f553b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77108988-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126220, "uuid": "51816f3a-f9f5-4b3f-8527-c5fb5dfb73e5", "comment": "Malware payload (IcedID)", "value": "f7eb9b03dc78623dbef3e2533273ec3c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126220, "uuid": "f4e40103-fff7-4dc5-ba89-d40e471886f9", "comment": "Malware payload (IcedID)", "value": "303577f0d6485dca47c39e2e117dbfff87d0b7f86a6ba54598390b1ad63b8832", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126220, "uuid": "cd52b8ec-8d8f-4cfc-a6f2-202cacf1334c", "comment": "Malware payload (IcedID)", "value": "9da1b116092d6e9502542e88d32f9ea80584582f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126220, "uuid": "d6f90237-0526-4d0f-86e2-62650a585cce", "comment": "Malware payload (IcedID)", "value": "f55cefe3be0a92811e0d9eb375063ad3665f48074bafc5ce88b2128bb59e3fa378cdb2aa99178607606798540d33f001", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126220, "uuid": "0a99851e-9206-43ee-804d-20529d484773", "value": "09B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126220, "uuid": "56fb9a44-a281-428b-9216-4f2febb4e622", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126220, "uuid": "fe0b34fc-f7d7-4327-9616-01e41e010d32", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126220, "uuid": "e2f05729-69fd-44c9-8975-9aac4f51a4a2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126220, "uuid": "f05efe44-f2b2-4d14-a029-c03249b586e0", "value": "document-1193081260.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349859a2-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137276, "uuid": "bbe6b377-d0cc-4d59-9267-62b047340fbc", "comment": "Malware payload", "value": "cef5780a7c8daa22e9b285466f5dbaa4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137276, "uuid": "6b5b0613-6625-43d4-b6bd-80f4037ad9bd", "comment": "Malware payload", "value": "3038a7e398c855c14aca987699a1974c7312dee8812c515de046e87242ccb9ce", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137276, "uuid": "28beb6ea-69a9-4342-96be-19a1e700d489", "comment": "Malware payload", "value": "b993aa8c36a74ea44e28c33042381510218f1646", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137276, "uuid": "02e6a1e3-fb60-4ed9-8509-a877a2e805eb", "comment": "Malware payload", "value": "75bc495c2b36a9442d5094b7018691c09e7aabd6dbb3f4ec74485453fd58a390a1f850feee5f4139772cecb976dd9d0e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137276, "uuid": "b5719f61-6c3b-48d4-bab8-84fe612df9a6", "value": "D414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137276, "uuid": "6b364b5a-a746-4f4e-839c-190686f19e85", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137276, "uuid": "7f2fe214-a6cf-459f-86e2-5a17dfecc5e5", "value": "3072:l3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:lJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137276, "uuid": "d0e81a21-a9dd-4bcf-9f07-14d3fbfcdc8c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137276, "uuid": "0d5839c8-84ff-4bb4-8a8b-73863b77b66b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137276, "uuid": "759c3dc5-b709-4732-aed7-2feb453abf8a", "value": "3038a7e398c855c14aca987699a1974c7312dee8812c515de046e87242ccb9ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e3bab6-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122350, "uuid": "4c27925d-4a4b-4082-8b4b-c8932d4091fd", "comment": "Malware payload (Dridex)", "value": "443a5a45c46399fcb0bd089163ff9172", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122350, "uuid": "61f2d39e-237f-495f-8eb8-4d3eec655d46", "comment": "Malware payload (Dridex)", "value": "3080d21d695da1567121a4c80670d85e7bf5c7bbcc62323efcae5d9c3bec88ec", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122350, "uuid": "e6968518-6c6d-4072-a755-0e622bc3f48f", "comment": "Malware payload (Dridex)", "value": "8f11e8109d62f4c5514c189fe8f4e8c56ff2391d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122350, "uuid": "46212e01-e2ea-4c64-bd90-d3cd5c52c146", "comment": "Malware payload (Dridex)", "value": "974068705015ea87c6b3857bfbc1b654f25d4e1111d9c6592856097932e6aded088c25e5025b3c1ca99b513c649d288a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122350, "uuid": "ca5a01c7-abd8-4507-bae3-902f53abedf2", "value": "5C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122350, "uuid": "5f36d930-7546-4b80-b6a2-b7f5ae35c5de", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122350, "uuid": "739fa644-4e6d-4ca1-8114-6f67a227be01", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122350, "uuid": "aa07b6fd-74b8-407b-b75d-ddd4dd82b6e3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122350, "uuid": "14ff6393-c407-4c6b-b888-177d1d9438fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122350, "uuid": "ea087d7a-508f-4c11-8b68-43d7cf82782d", "value": "3080d21d695da1567121a4c80670d85e7bf5c7bbcc62323efcae5d9c3bec88ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7af3b16-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114383, "uuid": "22f8a270-f260-4d0c-9b9b-0754d2f24c19", "comment": "Malware payload (Dridex)", "value": "f2bf97506f04d8a3ed03bcf3c7ea3947", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114383, "uuid": "f9822588-842b-44b5-9f0f-6f9964613b3b", "comment": "Malware payload (Dridex)", "value": "3096034c3e30f9d5fea17d852eb91e00474ade7993321c2676f7ff5ab8ae9d05", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114383, "uuid": "28b677f6-e917-4191-8557-a9f642595619", "comment": "Malware payload (Dridex)", "value": "96121cff7d38947c9dc35d569718b2e0faeefd34", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114383, "uuid": "a2f87a46-2e0d-45dd-856c-49f69cddebb4", "comment": "Malware payload (Dridex)", "value": "14ae7878ced7bb780d3faee20aa442786f0399ea45641b53cbdc9a22f3e185d92a199b806b166550bc2d89e65c178e6b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114383, "uuid": "3129d90d-6c36-4060-8c37-43b00834aae2", "value": "8714BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114383, "uuid": "59135e2f-db8d-412e-ac28-274f83f8388a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114383, "uuid": "eff1b57d-06a4-4be5-806d-575307bcb386", "value": "3072:k3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:AJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114383, "uuid": "a5b1844c-31ec-498a-a238-640d0c587937", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114383, "uuid": "060740ca-b9af-4334-b058-87d845c03ca3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114383, "uuid": "ca5ae7c4-b6c5-44e8-bbed-41b8c28d9763", "value": "3096034c3e30f9d5fea17d852eb91e00474ade7993321c2676f7ff5ab8ae9d05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233553ad-9188-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129945, "uuid": "8442b62a-82b7-4e2f-8d56-5d81f04c2ebb", "comment": "Malware payload", "value": "bc52ebf2661f8bfeb954ba880b932b9e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129945, "uuid": "d468b3ad-8699-4c15-ab6d-0fddd27fb8c1", "comment": "Malware payload", "value": "30e98ce91e8a2d98fbae608b75511a54098f4dbe98d19a915c7bb92949378d99", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129945, "uuid": "5f608485-da55-476a-b1e4-9d08abe2d5c4", "comment": "Malware payload", "value": "5111a4316121e25d057fb60e59298cc146065d80", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129945, "uuid": "9fe85afd-0de4-40bc-af07-8615215d06f6", "comment": "Malware payload", "value": "7b6736f7a3b8644aa6d7b7f45733e91b598f8ae296efbf3cfa267dad6c6599816c99afe24e0c08d29ac3d3faaa8e7796", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129945, "uuid": "ac98c104-d56a-4f27-8484-615bb3ebb42f", "value": "DD14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129945, "uuid": "c553c81a-719a-4078-b762-83920885d19a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129945, "uuid": "f76bc026-c386-4ae9-be37-9cb0537ed947", "value": "3072:I3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:sJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129945, "uuid": "76060dfe-5872-4db2-bb80-0edcb489330d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129945, "uuid": "aadc3adc-441e-4b7e-b07f-8a1dd2d6ed87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129945, "uuid": "227d638f-e4fa-4af5-b6d7-67f51676f5f8", "value": "30e98ce91e8a2d98fbae608b75511a54098f4dbe98d19a915c7bb92949378d99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e47d33ea-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617108795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108795, "uuid": "4cc53649-8951-4cb0-87a9-fd9242c61163", "comment": "Malware payload (Gozi)", "value": "7e98e8fbf2fec9c9d36896a08a26a97f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108795, "uuid": "fe2a3ece-e523-4d15-9662-4e9a1bbefcbe", "comment": "Malware payload (Gozi)", "value": "310ac7c48b536f71a16706f67fd4d2bed5d9f5708dd460cf3cbc0cd34f43a3ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108795, "uuid": "1c8bb044-b579-4372-a7e2-5df5a7602095", "comment": "Malware payload (Gozi)", "value": "d3c22e099df48f78765bba4b64e3f006a9e0bcdd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108795, "uuid": "1126b205-227a-47be-8680-6b1bde6dfdfc", "comment": "Malware payload (Gozi)", "value": "4a5be9e1f7ca94fe96ed520a02ceaf51684b2157274cc82dbcf29c7c4ecba3e8a92f3a78eddac41ed926927df57ac2d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108795, "uuid": "46e6e0ed-f53f-408b-bd4f-934637276317", "value": "8D848B02EAA0C034F5B307B945B747549B7E7DF19B3885CBA2D4259E1A2B6E0AF30753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108795, "uuid": "6375489a-2a5a-4853-ae57-ce4b577caca2", "value": "e735d9365950e14300009b933a49b131", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108795, "uuid": "eeededef-b2c8-45b4-b78d-494eee91e56c", "value": "6144:NbP57UDV0iDt00LKwwmFxDa9oNiEZ/LbseQB7G9wRENL:NbsV5t0gkgDa9oNiEZ/LbFQmrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108795, "uuid": "15341c6b-d3a1-4095-8249-19c763e32f59", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108795, "uuid": "3206975b-61f1-42eb-a04a-9a8540bc6850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108795, "uuid": "b5f6e403-15a6-47f3-9a6f-f756cecb520e", "value": "7e98e8fbf2fec9c9d36896a08a26a97f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e03ec55f-9124-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617087313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087313, "uuid": "8f6c0dee-a0c0-480f-b926-9d3c29fd9271", "comment": "Malware payload (Gozi)", "value": "712882ad6d85945cd0d81399757e6661", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087313, "uuid": "472c3f05-054b-4339-a29e-c753521ebcb5", "comment": "Malware payload (Gozi)", "value": "312a9a4de6d94deacc421063457c830453499c5848ec6c0aefc388c530cfb8f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087313, "uuid": "5a261c9d-9fbf-47d9-a914-6face73d527b", "comment": "Malware payload (Gozi)", "value": "ca4132d6791c084da38ebf73f83688fc30602ed1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087313, "uuid": "54f35902-4f29-4c5e-bb6d-f816a7385613", "comment": "Malware payload (Gozi)", "value": "b5a58dd4cf0b90a52cfa88fdd73ac4d9072323a628b4a2ae65b847a8d461a165118d16a5b4164beee0f989daf6ce5119", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087313, "uuid": "3d37497e-c4a4-4e7f-9dce-d744aea056de", "value": "1B74AE053BB0C5D9D2A521B44ECD8EA4E924FCAA1F20D21372D975DCBDF9F89262D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087313, "uuid": "1732ab82-9d33-49e2-ac87-2a0d99c799d1", "value": "77af713b1f2916ea138f9bb7258cf849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087313, "uuid": "72f8b0e1-3a2d-4f58-91cf-345942a053c9", "value": "1536:bepG5ACCny8GenidAHcz92ZIx9FxIl+YkSVoZlP1usBVEwnoxJashnXcX:36lGeExx9FmSSkfBt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087313, "uuid": "5a27119a-d733-45de-a108-fc7df99182f0", "value": 368265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087313, "uuid": "4f2b6f8d-8509-4cfa-a2e9-01755375f20b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087313, "uuid": "6943d41d-56b1-4187-9857-e0a69ce43d54", "value": "712882ad6d85945cd0d81399757e6661.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018d773e-9188-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129889, "uuid": "20683f93-6bb5-4b4b-ba6c-ffb73c33b3b1", "comment": "Malware payload", "value": "013fa959f826f9bcb5debfafa196d627", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129889, "uuid": "adf525f9-8435-4415-881d-65bd23cb2540", "comment": "Malware payload", "value": "313796262025cc6528ade5659e9b84cc53b34762ef3d70cbb5129a0e38479aea", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129889, "uuid": "845f5d70-2d96-4ec0-a573-22d95afc121d", "comment": "Malware payload", "value": "8dc69c7b6f08fc03672d18f1a07f5266dff2d392", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129889, "uuid": "87d6629a-ff69-4bfb-a25e-38d168ac4ef7", "comment": "Malware payload", "value": "a9291b1694dce85f09c43ff965bd79f799cf7a64b3a8eedd659c822aa5264733d0e1581f36690e65246d2010898f4cde", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129889, "uuid": "45ecf2fd-e719-4b4b-845a-ca198d66fdb9", "value": "4814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129889, "uuid": "7a047ef4-491d-4172-8320-f1877bec1cf8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129889, "uuid": "c6d30c3a-b132-4cc6-9b14-90936fc530dd", "value": "3072:j3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:DJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129889, "uuid": "258263b7-8f1b-4b10-bedf-93985a871ee6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129889, "uuid": "2ed49428-dba4-4c8a-a2b6-d830d6c01111", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129889, "uuid": "8aebd817-5791-4112-9660-10a1473b5873", "value": "313796262025cc6528ade5659e9b84cc53b34762ef3d70cbb5129a0e38479aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680156c9-9142-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617099996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099996, "uuid": "d0df86fc-78ee-4fb5-80c6-a7ced0b6adf1", "comment": "Malware payload (AgentTesla)", "value": "5277c4ff1caeab6bfad8543ef3e18a56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099996, "uuid": "a0a9c9b9-c03e-4d79-b4a3-356c3c93819f", "comment": "Malware payload (AgentTesla)", "value": "31441f795cc48150d5e38f31434bb388869222b0641bb3ca896c3e1816ea36dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099996, "uuid": "96becfe3-196c-419c-b22f-bfdb7fb8eecc", "comment": "Malware payload (AgentTesla)", "value": "e4088dc004efeb81f591b374df1560036575b68c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617099996, "uuid": "8e2075b0-be27-40e3-a578-c8271619d673", "comment": "Malware payload (AgentTesla)", "value": "4853b936ffd49fab3ec3c4ea04e7fd10200ee044602c49d62522e2e7505bb28a8608cc2bb8b57619a9b55893605a7a7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099996, "uuid": "f5a42021-00ae-4aa1-be05-98c12e89d59e", "value": "D6942364D82855D07E7CBCE22A28AC6DBD20DD5F05685FECBA1FCA93C84C97794B0391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099996, "uuid": "a8a7768c-0fc6-4b14-860d-5293819ca7fe", "value": "12288:YzNjYlXHgM5kM6IubOrXbiPrtog966f38y2:EY9HZr6Jbnpogf38y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617099996, "uuid": "83e30410-1299-411a-9c13-8495a0a3c84c", "value": 442166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617099996, "uuid": "f1f1fe14-2aa7-47c5-93c1-2b4bfb8dce83", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617099996, "uuid": "b9a256b4-7d23-40d1-9830-4872cd642a36", "value": "BL-210318L.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3498e5d6-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617087884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087884, "uuid": "0bebf84c-433a-4d58-8ab3-fbc6fedce491", "comment": "Malware payload (Dridex)", "value": "ad6c1f89a3a8f6c1204ca2d608783ea3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087884, "uuid": "653e1de5-24ab-49c1-9c47-255df068971f", "comment": "Malware payload (Dridex)", "value": "319e827a3e5449718564dabf4576491763574c08f049c2d6bfa6191da79e26c8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087884, "uuid": "7c310eb0-5543-4184-89f2-61b8cada6de2", "comment": "Malware payload (Dridex)", "value": "33bd117533d23cd89ede54bfc0ff16191c06347e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087884, "uuid": "67539d69-6311-43ec-93c1-68e6323f8ebe", "comment": "Malware payload (Dridex)", "value": "61f46913e70a72cec801e4393983d3241076a76909800fd4105afd27d19542d5772ba61718f7ea17abed8be78e13ff2f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087884, "uuid": "f96e93bd-2757-4c0e-a07e-33ab7c898a66", "value": "E514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01E164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087884, "uuid": "09846b55-8a59-4e33-9382-4090e7643477", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087884, "uuid": "8f9289fc-ef2f-4085-832c-8e2c5b7081e5", "value": "3072:01i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:gi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087884, "uuid": "25d0cac5-2737-4400-8e80-a72610a71298", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087884, "uuid": "606a988c-6d9e-4a49-905b-280bf7d0ee8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087884, "uuid": "db59222d-3254-495d-94e9-a9338f0710ce", "value": "319e827a3e5449718564dabf4576491763574c08f049c2d6bfa6191da79e26c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8f109f-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617133268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133268, "uuid": "eeefc35b-ece7-4487-9302-54d1c1497dc7", "comment": "Malware payload", "value": "c08c5230dbad9ab80c292dacfe0c3ddf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133268, "uuid": "df3ace40-d58d-41aa-82f0-1287ae7d5a10", "comment": "Malware payload", "value": "31c58db41686beac7731ea00443ce41e96edb2c5425b83f073dcc8fc0f22a62e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133268, "uuid": "4cbc7bc4-37d1-4081-99cc-3b38f7a9768d", "comment": "Malware payload", "value": "2c4f309a6f8a3afd12b01f894e4d87455b7bb1d6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133268, "uuid": "714cbe1d-a959-4959-8912-3d187268a23c", "comment": "Malware payload", "value": "352a1a0f440282fe605be7be9cf2a5a69116163a106783876330f9be1620372d5b6012cac425bad9b64326968aeeac37", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133268, "uuid": "4ae8140a-43f4-443f-af90-b21ab6fb84e7", "value": "1B14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133268, "uuid": "2fb842b1-6c68-453d-98d3-1037ae531395", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133268, "uuid": "e4124f01-a9dc-4859-a3b5-b1d490dfc502", "value": "3072:N3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:tJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133268, "uuid": "cd5e3a09-4c5c-4858-9d9c-1203c24c4484", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133268, "uuid": "e5efbd04-66df-4226-a5e1-7a44cd66fe6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133268, "uuid": "a198b204-992a-4327-a419-b8c767d93217", "value": "31c58db41686beac7731ea00443ce41e96edb2c5425b83f073dcc8fc0f22a62e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5ca51e-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120136, "uuid": "4d083f85-f60c-4d92-87c2-c00d5df8eb4f", "comment": "Malware payload (Dridex)", "value": "78988b295cdb7778f1fe995f9a5ede95", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120136, "uuid": "e8533642-506a-4806-b326-6acb9ecb3e9f", "comment": "Malware payload (Dridex)", "value": "3226289c1e68592a0fe87ca114f00aa79c1da2310229abcc25ef3f1034b8a44a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120136, "uuid": "4a028842-7867-4eef-a736-66de4d043462", "comment": "Malware payload (Dridex)", "value": "d5e6b6847334b5e6f90e9b966bd5de483d81bd89", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120136, "uuid": "10fc2efa-8626-4931-8906-76c990de9175", "comment": "Malware payload (Dridex)", "value": "d672e0cf6231a0087e5ff9da8b729591375f2ce9815344d6b9dfc640ce3bf5200091b9fadb228205101377e7162cf398", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120136, "uuid": "70dd791d-9c13-4f5b-92d9-f6ed5544cf50", "value": "7014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120136, "uuid": "7321c00c-7695-4c68-890c-e916a25522bd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120136, "uuid": "859b7b56-a235-474f-be8f-c9958f6517c7", "value": "3072:33PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:vJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120136, "uuid": "314add34-eb23-4509-a6c0-482e13e4a6d0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120136, "uuid": "e892adb9-a22d-4d45-bfd2-8ce020e74e20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120136, "uuid": "3c98ae77-ccac-43a3-9f00-7eff70a79abe", "value": "3226289c1e68592a0fe87ca114f00aa79c1da2310229abcc25ef3f1034b8a44a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5e4cb6-910d-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617077163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617077163, "uuid": "1f01227f-cc6a-4715-957c-e27cc73164c4", "comment": "Malware payload (RemcosRAT)", "value": "fc1b3067306a863caf88690b9001c2d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617077163, "uuid": "a8f60a13-b7aa-458a-8319-77dfa401c7ac", "comment": "Malware payload (RemcosRAT)", "value": "32560ccc4af2d37c587bbc551e1dd8127b8efaafb199f74c18ec111a812a7f30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617077163, "uuid": "06c730d7-ef31-43c7-8807-3655f769cc1a", "comment": "Malware payload (RemcosRAT)", "value": "8efc45dfa94301be70e623e9bf50d5fe3e4dafb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617077163, "uuid": "9fe30b95-dd22-4e41-9521-4a94b33af09e", "comment": "Malware payload (RemcosRAT)", "value": "94b57ccf595a384769cc5008fcc83c5c7380020b984c8ebe12cb7102346afcbea2c0e2178ceace1f82d763d69586381b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617077163, "uuid": "0221bdd5-81de-4b9c-9d8f-ce4d3d98b938", "value": "3A168D227280553FC05B0B39187FAA75993EBB713A13D85767F09D8C8F716813A2A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617077163, "uuid": "e76b5a0d-222c-4cbd-a6ba-c1de3a0903d6", "value": "f8a12be64b382e27cf5c35f26bac329b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617077163, "uuid": "d930d339-a097-447a-8edc-2ba0fcdd0850", "value": "49152:N64wHqj3fVbShW+Nwl32KoJ+6/i8QA9IPUh6IqsT0J48U:NhwHqj3f29J2A9IPUh6Iq08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617077163, "uuid": "926b768c-6856-464c-890b-18cf7d6d01d1", "value": 4286464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617077163, "uuid": "6933b385-9edd-4a59-8da0-0de55bf707bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617077163, "uuid": "f9c5a044-76a3-4bad-873f-1b275fb41f58", "value": "32560ccc4af2d37c587bbc551e1dd8127b8efaafb199f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62ccc2ca-91b3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617148520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148520, "uuid": "2c626ce8-82db-4566-9605-539528c5febb", "comment": "Malware payload", "value": "0d8c7389f4104937975e368cf3b248cf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148520, "uuid": "1507b90a-1e27-41b1-84b3-acf42cf99abd", "comment": "Malware payload", "value": "32688450b72fb4d55df90d5524b8dc38f7f1d6d6b76aa2faa6dc747fd87a030c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148520, "uuid": "6f402424-9f26-4343-ba42-9cbcf66b0e44", "comment": "Malware payload", "value": "1d905cee474878a19326e105ce032c509baf8e84", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148520, "uuid": "c21a0bb0-6a07-4a40-b795-977890ca1f95", "comment": "Malware payload", "value": "d2e0982c3e1bba3efa8e0ded2865103b1e7b838955b2cc1caa39f4fd2949125901f1dd35526ebc6b336a5e3775983795", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148520, "uuid": "5b578f7f-a887-45eb-ac26-8cff82135a06", "value": "0914BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148520, "uuid": "1be0dd8d-1e1f-4394-9646-9e7eb13966ef", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148520, "uuid": "cbf6338b-1d13-41f6-8cd8-3cbdd40697eb", "value": "3072:33PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:vJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617148520, "uuid": "a18ea98f-e34f-45ac-97e8-aabe09deeea1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617148520, "uuid": "62180d62-5f4b-4bf5-a045-c55d763e32e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148520, "uuid": "48c00629-033a-419f-842d-451b5e7a7700", "value": "32688450b72fb4d55df90d5524b8dc38f7f1d6d6b76aa2faa6dc747fd87a030c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97937fba-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617082896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082896, "uuid": "0ae6240c-6d4f-4c6e-8633-f41edd0719d8", "comment": "Malware payload (AgentTesla)", "value": "145c5e94dc5f1514fbdb52e68b7c78b0", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082896, "uuid": "360c7082-90f7-4dfc-a2a3-7ee65df4de93", "comment": "Malware payload (AgentTesla)", "value": "32709eedf84e2ce481f8e508dfe7bf7b28ee7f6945f57120b1121a72372570b1", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082896, "uuid": "34a4e45e-1059-4da9-a016-5026068c4547", "comment": "Malware payload (AgentTesla)", "value": "ff9fae30e05f858127853cad53dbbb69f0bdeab1", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082896, "uuid": "b0a33aee-377a-44f4-82d9-2c0b02480054", "comment": "Malware payload (AgentTesla)", "value": "a20207d257090cb19f8af94ce072df84f1eff5bad01ee1e320c09e32c304a2d2b78ddd537d3eec5c48de5194eb8ae656", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082896, "uuid": "cebda5bf-10c2-43cc-9710-928fec5b9558", "value": "33A42371D11B68820BC75307A179BDDABFF12C65174FDB9082E3B096A60F172B24C6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082896, "uuid": "fd5b46d0-a11d-41e8-899f-19a784e3ac05", "value": "12288:t+3V3gDGRoqEjZWQ8gA+7tfQy3npMuz1qICHwiBq9:tyg4oLAQ8gP7ZQy5MuzGwiBq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082896, "uuid": "da5e7dd6-4dd8-47d9-a11f-d87ec74e9888", "value": 479223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082896, "uuid": "f9072214-da20-4ded-9f0f-25a47d84ec48", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082896, "uuid": "fea2b12c-36b7-4d25-baf3-2bac18bf5643", "value": "Proforma Invoice No.42037 For USD.78116.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4fc83d-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120705, "uuid": "78ddf261-45b4-4b3f-9529-29445d291ee8", "comment": "Malware payload (IcedID)", "value": "2e8379d7ec405304495ec153c8b8a373", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120705, "uuid": "01f48a9e-63c5-4e60-8aca-8249d7a9f0f0", "comment": "Malware payload (IcedID)", "value": "329f7b8fcfb8f8258c91e4cdbb7f2ee14f0ff9ba261d737fa38271264e191460", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120705, "uuid": "02e3b1e1-8336-4ce2-a416-2d02e009ab82", "comment": "Malware payload (IcedID)", "value": "3a032904c2261a79f93a50bcb84fdf18771d8148", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120705, "uuid": "33975e2e-becd-463b-9c94-9d02b118a671", "comment": "Malware payload (IcedID)", "value": "7caf055877f5f946619cd63a5ac12077b9899171bbfb77295ca8ff743e454879e83183a33800c5f9b12fdb348ea5a3c7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120705, "uuid": "59e7fcc6-49b2-44ca-834d-f2b7ca4bf3d0", "value": "1AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120705, "uuid": "43318ced-cdef-4986-b488-deeaaf6aa876", "value": "3072:c2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:czxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120705, "uuid": "08f0d5de-beff-48ce-9343-b4c49c2e03a2", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120705, "uuid": "ec82985b-694f-4aa6-87f1-a5ed7c1b3b94", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120705, "uuid": "349ba71c-6a18-4d4a-acee-e735990a55f4", "value": "document-148744468.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20660e32-918a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617130800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130800, "uuid": "a2d71e48-37df-4212-b89b-040a1700949d", "comment": "Malware payload", "value": "f17f90cb19b78cf2e97f4767a6ca4703", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130800, "uuid": "fe468b70-9072-4a37-b43f-759cefeae7e7", "comment": "Malware payload", "value": "32ad6364a68bb8fbbf330c93befa18f29e25e42a883f4bb69f0316a7bdc7d507", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130800, "uuid": "fc89da59-5329-4ff1-bbfa-f05a0de28747", "comment": "Malware payload", "value": "7ca564b7047a4b7c02ee455251cc9b2d6391b3f5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130800, "uuid": "af607718-8050-4a4b-8858-7211efd98f1e", "comment": "Malware payload", "value": "c485dc394c02af239e3fe09e4cf5cd11c9735aabd96673d6d36edbaf01e9afa381255f12938a7acef95ecf169619c592", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130800, "uuid": "7ecfa556-262f-42f3-9e8d-c66afaab3353", "value": "4E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130800, "uuid": "ee5c1c73-1b2f-4c14-8be2-c5b38b7d853f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130800, "uuid": "9f9d808e-f2c5-444b-9f08-2996e2209bdf", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617130800, "uuid": "d7ad32fa-6c17-4f80-8c54-1c4a640a2204", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617130800, "uuid": "e073b40e-ce7e-405a-86fb-10e016f7ecd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130800, "uuid": "7fe1b67b-fbe0-44f3-8762-0e42fa455d2f", "value": "32ad6364a68bb8fbbf330c93befa18f29e25e42a883f4bb69f0316a7bdc7d507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ba47ab-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "a8235b75-5d4f-4620-af0e-beb96910eed1", "comment": "Malware payload (Dridex)", "value": "550f0d565eba43b7c5009e93552c9aff", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "4d6ba1bb-42f8-44b2-b46b-102d9a1a8bfa", "comment": "Malware payload (Dridex)", "value": "32be8a019b50c38681c64e642702f14f00e815b0343494271227d90e6ca72a95", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "965be1a7-afd8-4c1f-b936-d4aca388a9ad", "comment": "Malware payload (Dridex)", "value": "292a6d9752a7ba9561983b31784c2abcb96bda0e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "db9aa6dd-dc2c-4d69-bf29-b4dc40da1d96", "comment": "Malware payload (Dridex)", "value": "b87f6281cd0a9cb9ee1682b2b8cbc84428925baf74c463d55ccac442209d0e395ae96705f41c3562ff400c77718660d2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "68d57ea5-a085-46f8-b850-2a10eeae9f9c", "value": "2F14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "ea7fe1b8-77d9-4651-9e12-446e36067c45", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "b3685136-806f-49ad-8357-2e3b5b13fba4", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114103, "uuid": "4959d7a0-fb4d-4663-9c6e-704677b8179b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114103, "uuid": "9f47f5e1-1874-4756-a444-67635444f2e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "868134ec-5cbe-4abd-8813-980a2610d0c2", "value": "32be8a019b50c38681c64e642702f14f00e815b0343494271227d90e6ca72a95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97d9b51-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123003, "uuid": "a1df77e6-cee3-4b46-85cc-75b484de21fb", "comment": "Malware payload (Dridex)", "value": "f59cf2ece2a22162881a83bea7dd6ac6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123003, "uuid": "abb8e65c-e024-41a9-9b0b-4ec5a6df3279", "comment": "Malware payload (Dridex)", "value": "32fd86d1a11b5c2691f336238b082f002ad18b0d2bd78b7f6efaebcbd90f16bb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123003, "uuid": "b0b7777a-9435-463d-a78b-5b7d1cd81ce0", "comment": "Malware payload (Dridex)", "value": "c64824084e28a77acac77154325763f49fbdb358", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123003, "uuid": "75f616a2-22c5-484b-90fd-8d56abf294f7", "comment": "Malware payload (Dridex)", "value": "15c1fcdecd59863082ee7bfa562f3484004abce93905704a20e8003c918cf9d8f62b719d276879ce30391a584f90f817", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123003, "uuid": "bcc5b1c1-4d82-4b4a-9cef-a2e5214c2bc4", "value": "D014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123003, "uuid": "d3e3732c-b11a-40af-9fb3-48dcf3366486", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123003, "uuid": "acc3b824-647d-44f0-9b88-0b50a0f0406e", "value": "3072:h3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:5Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123003, "uuid": "0f649f8d-9ef2-476d-b0e8-70ee07c3c280", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123003, "uuid": "bef58e4b-a66e-496d-9d93-9704309fbe18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123003, "uuid": "57f40bd7-4b03-4247-9a0a-c4de1f28fa9c", "value": "32fd86d1a11b5c2691f336238b082f002ad18b0d2bd78b7f6efaebcbd90f16bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accd29af-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127170, "uuid": "d528fad0-7765-4fe3-a7ec-597ebff53fe8", "comment": "Malware payload (IcedID)", "value": "550659275cecba49917521e1cd885754", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127170, "uuid": "74f66faa-6d44-48fd-8a10-1c2242ac9624", "comment": "Malware payload (IcedID)", "value": "3373c99f5c72995e1d7e8ea6816fd33dd620cb87814407860d6d3e4e6fbea014", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127170, "uuid": "ce14963d-137f-4b96-ab58-13db27462ab6", "comment": "Malware payload (IcedID)", "value": "ae9c3b872c4a2b708b27171ca379090919c94c91", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127170, "uuid": "70a5aaab-4fe4-4c3a-9c27-563b4ceea764", "comment": "Malware payload (IcedID)", "value": "c7a161b36b2e41b0d0478a42c1fadb1f32cd976fefce6e87c151400ae2e85c49e1c4f5e809f8a8195eeeb9724f9585fc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127170, "uuid": "a97a1e19-add3-45aa-aeb9-ec22ec0a35be", "value": "DCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127170, "uuid": "8596a63b-62bf-48c8-b339-fcfb931a20af", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127170, "uuid": "e4912af1-cd99-4fbe-b0bc-1e238d67b15d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127170, "uuid": "8e48cd36-2696-4b74-9e77-7d8fd0603875", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127170, "uuid": "17d29ca9-80b2-43e3-87b7-2e7d7e7236a3", "value": "document-302561308.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d6d0ad-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136491, "uuid": "dc616cfb-c55e-421f-95c2-bd4b4acb95f8", "comment": "Malware payload", "value": "2c02215f12acb25281e1bb9e5a8c8b88", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136491, "uuid": "cc88563e-7198-4573-9d6a-7e2eae5fc66b", "comment": "Malware payload", "value": "33a6cfea4c820aba488dc2a8607d5f2be113599d0a9ba20e90105aa86f5b04d4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136491, "uuid": "1b3ee6b6-f30b-4862-9d52-2f0e545ad4b6", "comment": "Malware payload", "value": "394321e26412b820796154f1805531033661351f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136491, "uuid": "3d775ba9-f1eb-4270-9bc4-32b0a1e23a39", "comment": "Malware payload", "value": "9fc2c4ebac6f643f354935338e719f431da9e71162d8402004bf6f0b2bf27349ab83874e654169f4ac6ad54da2dec1c6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136491, "uuid": "53bd67fc-e5d0-494c-be31-c58b61acdc15", "value": "0214BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136491, "uuid": "6a51137a-ed91-4353-98b5-b0f40feb8864", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136491, "uuid": "0ddd7bf3-eb96-4efc-b859-59ff0b2fc8b7", "value": "3072:D3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:jJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136491, "uuid": "922687c8-68fc-4d3f-89bd-b6774ab6457b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136491, "uuid": "f568aa57-44c0-47b1-b503-f2cee52bd299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136491, "uuid": "d988bbaf-3c7c-4a42-a01d-42eac5177c83", "value": "33a6cfea4c820aba488dc2a8607d5f2be113599d0a9ba20e90105aa86f5b04d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fa9c5f-918e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132497, "uuid": "f5441539-7cb8-492c-a9b2-fc4dffa113a2", "comment": "Malware payload", "value": "314a5e9054650389361ca4cc60ca15b2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132497, "uuid": "e6625c88-7b47-4051-af72-f43ba6000971", "comment": "Malware payload", "value": "34969acb894b1dbfee506f3684c14c0c72dd6cef528a2577d11985ea18d364dc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132497, "uuid": "0488481d-22de-49ac-86b2-a3c9fb9e8748", "comment": "Malware payload", "value": "1859bd98f73c825159cd2bdf836db0fcf9419b0d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132497, "uuid": "fbfc6592-ee0a-4ecf-85c0-5f879377b1a1", "comment": "Malware payload", "value": "5ac3dc14de6bfd9e5f68fc44ec52b30191a11fd4803177596f55c838032077d03f1d40c4a2711ede810745c8e27c979e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132497, "uuid": "c2b3cbfa-ec27-47c8-a31f-d9764c983e3f", "value": "6414BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132497, "uuid": "4c665522-1868-4a64-a1cd-c1f1fc0668d9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132497, "uuid": "e36fda9c-cc5c-4bce-9dd5-ac0e4ee09375", "value": "3072:Q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:0Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132497, "uuid": "8564c027-9ea3-485b-8611-60aea5222e2a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132497, "uuid": "e2b023d5-f277-4203-adf2-04b409f593f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132497, "uuid": "1ab6c99b-e167-4a32-993a-bd01032cd3f6", "value": "34969acb894b1dbfee506f3684c14c0c72dd6cef528a2577d11985ea18d364dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaf5a61-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142742, "uuid": "2fe87277-d921-4b37-88f1-0dff5076a224", "comment": "Malware payload", "value": "684412612788d5a95d78b8e3c4f74a85", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142742, "uuid": "dafae4d1-72e0-4e25-bb33-5c8f52cf43fa", "comment": "Malware payload", "value": "34c1d4f23d6e50fb8424357b2e69c7ff8a24b67e03d9ff42e9414cf50c9de262", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142742, "uuid": "8d0a0ae9-4271-426d-9e56-b90dfad18fa5", "comment": "Malware payload", "value": "65d2d90fe3db14b0ae6cf65027fbf3c45d97f412", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142742, "uuid": "229d79ca-7f6b-4236-8061-fe327144d448", "comment": "Malware payload", "value": "1759ff6d7d6770d33aff38731e81423b73ae943f19d6d0906563f92db3bc0294bcad4ff4ca1c504d1f3831fc252ea731", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142742, "uuid": "850bd6eb-81e1-49f3-bbd2-4ff7f4b7d1f9", "value": "BD14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142742, "uuid": "044fa4ad-2c0d-429d-a5e6-7b3cea68cf0c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142742, "uuid": "e0c29d28-f4be-41f6-8474-f6e42838b5cc", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142742, "uuid": "1dbf2811-0fcd-4eb3-9693-6cdd60f2390f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142742, "uuid": "6193787d-2fb9-4fe1-b8bb-3442ffbeb5ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142742, "uuid": "7071f0bc-65b6-4316-ae86-9c539bf8a0d8", "value": "34c1d4f23d6e50fb8424357b2e69c7ff8a24b67e03d9ff42e9414cf50c9de262", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe01465-918a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131087, "uuid": "e540731f-17e9-4662-a41b-6ad4df05bca5", "comment": "Malware payload", "value": "60864e2ca6fc8350ba7ae85af358312a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131087, "uuid": "c6ccad3c-8ccd-4935-94c2-ebf4063b1eaf", "comment": "Malware payload", "value": "34cc3a61beab4cd9c98a464857f53a15fb19dc2967dd069562218d2f1e78a525", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131087, "uuid": "c9a4e2ff-77af-4f09-b5be-c692553d43ee", "comment": "Malware payload", "value": "63d119110e89bf5cec666889ab6070f8e91e8814", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131087, "uuid": "fce3d576-fe92-48ca-b167-b051d8615dc1", "comment": "Malware payload", "value": "f62668d0ca5e0ab1fd3a062b1cf31f8b7b6387eafa5882cc53a36c64d818ec0baa8b744621c62a80f2a0baa8829ac939", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131087, "uuid": "da521324-7e49-49cc-90d2-4a9ff009bcdb", "value": "3114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131087, "uuid": "85456f09-fd9c-4da9-920d-195e020b54bf", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131087, "uuid": "2d91c0a4-6e02-434f-857b-1e2e54301581", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131087, "uuid": "55891570-9a5c-4c52-99fb-f1136d4731ad", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131087, "uuid": "d0399e7a-ba5e-4324-bcd4-18f0dfb1676f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131087, "uuid": "043aeea2-0be5-422a-829d-3055d3f920e0", "value": "34cc3a61beab4cd9c98a464857f53a15fb19dc2967dd069562218d2f1e78a525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a05cb4c-9117-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617081531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081531, "uuid": "2890fe07-55d2-4ef4-bc3e-4821997e4194", "comment": "Malware payload (AgentTesla)", "value": "2b96912fe32bf91585e7edefb24d46e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081531, "uuid": "3ce2d2c4-1f35-45f9-85d3-51367de7421d", "comment": "Malware payload (AgentTesla)", "value": "350aba9e46e2c0cee4b8e1fc57e0ca0a8beccfc63cde592d735da35ec10f62ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081531, "uuid": "280f6dcb-6b42-467f-8ed2-ca69d116b0b5", "comment": "Malware payload (AgentTesla)", "value": "afc01804c5d764f9813361284369fe8a44ecb17e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081531, "uuid": "1fa22ce6-fe96-4d8e-b57d-965c45efb50d", "comment": "Malware payload (AgentTesla)", "value": "1a741ea31497e10c6dfc85869423729e45c0f8e422b66db1a2db27eecc54e953285224ddce2d6e09b2271cbe32b2402b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081531, "uuid": "76504249-821f-412a-8c49-1b0c3cef7e68", "value": "E69423BA53663523B0DFF048B7868D4B66604CC8D9FFDF1E53C41EBA2E675864006A87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081531, "uuid": "edeacabe-5e42-4ba9-9c19-bbdb0eefdf51", "value": "6144:y5nejBy6HblmVnBODTLAI0Mke/94YIihTe/cL96xtGSm1od6xoLR4YlfLH+3NGbP:gFmkODvANMplZhTBYZbdSod9LHKNAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617081531, "uuid": "c48d12d3-084b-4e9c-83c7-32bf6aa56ec6", "value": 439725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617081531, "uuid": "33990e15-f718-4dba-bb58-ab0d4cd98c50", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081531, "uuid": "eb96bcb1-33a9-4808-a76a-d3373b027e4b", "value": "Qauntity of purchase.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e5c886-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120615, "uuid": "31c54bf1-0613-4e06-a77e-1bbebd474cf2", "comment": "Malware payload (Dridex)", "value": "3440dbbf18400ce45418270b92d4df30", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120615, "uuid": "8171b93b-1376-4418-8d0c-b483c4f683c5", "comment": "Malware payload (Dridex)", "value": "3520378fe059e67ed34cf6f7a15ac5463f18ee9a756239c68613acf166abd1eb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120615, "uuid": "647df39e-3a40-41fe-9fde-14b4b6437cfb", "comment": "Malware payload (Dridex)", "value": "13d070ad26b404dede65292ca96083b8f452c898", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120615, "uuid": "ff388e48-fb3e-4ccf-965f-40bd29ec2d75", "comment": "Malware payload (Dridex)", "value": "548ce4b29052fa0b161c50e5ed95e0921763163fff8bbd6acfda8f8f4706ec9eb5028b5ba633c92471b1b1c7c98f60cf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120615, "uuid": "92a77597-2c92-4f62-aad9-6f4af4f458f2", "value": "2114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120615, "uuid": "ffec5891-0690-4eb0-a7d5-0a25d0cce484", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120615, "uuid": "8d99fbbf-c03e-4575-9d71-bc6ef0824fcf", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120615, "uuid": "661a749a-8e0b-4604-9134-f4c2c67a8053", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120615, "uuid": "77e2f9e5-42e5-4a91-a740-a7b2e4e1aa2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120615, "uuid": "c8d92105-9c9f-4598-9929-32c09c1ac794", "value": "3520378fe059e67ed34cf6f7a15ac5463f18ee9a756239c68613acf166abd1eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ae8a89-9190-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617133332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133332, "uuid": "44edee5d-1562-4db9-8c24-74a6c1065c6c", "comment": "Malware payload", "value": "1f84178c29ef11e885dba1a88d66a224", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133332, "uuid": "c63c33c0-40a7-4152-b60e-a12d6bd10d6d", "comment": "Malware payload", "value": "3530d7c6ce645c915adf2ebea4d7366c957380ae84945d89b2b55522619452c0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133332, "uuid": "fd524129-b276-4aab-b398-d5a177887ded", "comment": "Malware payload", "value": "0509eba3ff5861009e1c215334d80998eb4e1fad", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133332, "uuid": "44bab87f-c3e2-4a50-8b18-10821c4ac8d4", "comment": "Malware payload", "value": "0a824c8f9a501301200662879b402a5e055b6ec264e0826834c98c56c4cecefc4353fc683961c0c65a28957b32e8279f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133332, "uuid": "0380e373-643c-46b5-ab08-d22c94a25c62", "value": "9A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133332, "uuid": "7f71ff19-bc67-4652-afcf-7ae3d014c005", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133332, "uuid": "8b3f3029-ae0b-4806-ac35-b6c9e7a8ac55", "value": "3072:Z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:RJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133332, "uuid": "ce1b7ebe-51a6-432e-9b26-892a30497397", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133332, "uuid": "92bdc77c-d7e5-4081-88e4-e38deb8d9d55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133332, "uuid": "0e202d32-7c9c-4c47-be73-3cc3569e281f", "value": "3530d7c6ce645c915adf2ebea4d7366c957380ae84945d89b2b55522619452c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b6439c-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115263, "uuid": "e92f60d5-4b18-4421-95a8-9a623f8acf06", "comment": "Malware payload (Dridex)", "value": "ab0da459413d960c31253134aca63a77", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115263, "uuid": "fdf7651b-4615-435a-9ad5-e1a468cf1c62", "comment": "Malware payload (Dridex)", "value": "3543fcac66f07f1ef3482b4b44b1a4c4219eafe4662e40f4bbaab85778792466", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115263, "uuid": "bc584b74-6130-47eb-8073-852924217c74", "comment": "Malware payload (Dridex)", "value": "aa6555f9dfccf7e5c0340a4cb895c7c97c11830b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115263, "uuid": "86a5e2cf-b1c9-449c-a341-632b7fb159da", "comment": "Malware payload (Dridex)", "value": "c11247468d9ced9eb90942b0bab5b7905f1f29a36cf2c8edceb28e1da8a34c8527974b1ec36181ec21a8d8961ec9689f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115263, "uuid": "c0e463c3-b3b4-4f75-80aa-7de6e157e2d8", "value": "7514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115263, "uuid": "42081810-412e-4dec-bf6f-6fe861e5bcc5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115263, "uuid": "5951d221-2ab8-40c5-bf63-f5fbf4f1c570", "value": "3072:D3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:jJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115263, "uuid": "c5363b31-c56f-4d8d-ae07-028bfed82f6e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115263, "uuid": "1846c774-68cf-4843-8736-d64f0e488121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115263, "uuid": "aee163f7-0da5-4371-a64a-eb9f2d19df94", "value": "3543fcac66f07f1ef3482b4b44b1a4c4219eafe4662e40f4bbaab85778792466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4286d047-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126562, "uuid": "49898a86-c639-4b2b-9a0f-b069cc3eca18", "comment": "Malware payload (IcedID)", "value": "4dc6950dbc7ec2e35331346b5dea8e79", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126562, "uuid": "58f98a7f-92eb-49c1-b887-35a0ae74d003", "comment": "Malware payload (IcedID)", "value": "35d614c3b0cbb5df55e00ff98e8384cf3bcb553ad350e93f86c2d6f47e2b0cbf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126562, "uuid": "cf7559d0-4e0a-4991-bd88-fa9e8dcf8694", "comment": "Malware payload (IcedID)", "value": "8f44c15ad06edb02492ac81941aefcfdaa82111b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126562, "uuid": "892defd7-707f-4e7c-bf8c-e26873b91384", "comment": "Malware payload (IcedID)", "value": "63881a27acb317b38a6a0374d6c0706b90fb6c4bb62de1e8ca259db063be2fd7f40c2d332dad1a9645f3cd29ee4990b3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126562, "uuid": "1e1712a0-5b3c-468e-a75f-01262183fea4", "value": "D8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126562, "uuid": "a0d6486f-a138-4f90-90e5-cdb0b16a932d", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126562, "uuid": "ab8e126a-22d1-4563-ab67-099c660af1c5", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126562, "uuid": "1adfec22-d485-4b1f-b81e-7af12bcf0388", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126562, "uuid": "a1f2d7cf-4918-4437-8a65-cfac660ac10c", "value": "document-2014172652.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5142dbd-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120392, "uuid": "7538cea1-944f-4652-b17f-0e0e7d11f241", "comment": "Malware payload (IcedID)", "value": "9033884e0a5a281e6c65cf67dce7224f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120392, "uuid": "b6b804c3-4d3e-42bd-809d-a32fb4ebac80", "comment": "Malware payload (IcedID)", "value": "362f119f37c1f44ff7d9dbab58abf60515272d60a5cd8d24c3ea1bd95ef1e948", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120392, "uuid": "ff17f6a4-574d-4891-abf4-9294a96a2b7a", "comment": "Malware payload (IcedID)", "value": "73d35247f92793c16b80b4aafcbee9463b7513de", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120392, "uuid": "1b4fd482-7c82-4db8-8b1a-9a1ca8ededea", "comment": "Malware payload (IcedID)", "value": "82494c55a3dffd70c57c3759d6da16dc36e98b03b2f3f2be5e4654e5674a86ddc395d0e9fa34bcec0be3dc9a52268ba5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120392, "uuid": "69520da5-2fd2-430e-8a86-12bea109f5bf", "value": "77B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120392, "uuid": "56db5289-f155-4f30-8ac6-b37af5648418", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120392, "uuid": "ef8c0b22-50e6-4de0-ba70-be2569fafb20", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120392, "uuid": "ea0b005c-056f-47e6-9b3b-d0ad3f01584c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120392, "uuid": "ac4c7f7d-6b27-41e0-8cf8-c0d57734f637", "value": "document-667676838.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b5db53-917b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617124396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124396, "uuid": "8cb7cb37-47c2-473c-855e-ce2a074165c5", "comment": "Malware payload (Dridex)", "value": "d55dade6aa9b57ebb20cff2c18f5519d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124396, "uuid": "595eec4e-ae55-42d9-b109-6abed374cb05", "comment": "Malware payload (Dridex)", "value": "363b1b0b70ce7fcbcc08782ce18a2fe0567bd5c224f2b3c543079195baf1ee11", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124396, "uuid": "50eac0ce-25ce-4581-9051-99664747f14a", "comment": "Malware payload (Dridex)", "value": "7fd58a83b608124aa2b0a8cf3a9d6bd7e165d8ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124396, "uuid": "96abc601-cf1c-4b39-acc4-94f268ae064b", "comment": "Malware payload (Dridex)", "value": "6b5ae34c893a9000e539b489ed150cfcc18242f1d94c14f49ec87c7f062c882fd3b80668bb741d5381ccc4b88fa93a59", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124396, "uuid": "58a8ff88-cf90-48c9-bf18-911ae554902b", "value": "2114BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124396, "uuid": "0c3b0b2b-3b7d-4167-b47b-089c4e285af4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124396, "uuid": "3ad004f6-9ddc-4cb0-8090-540ba6d3db07", "value": "3072:b3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:7Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124396, "uuid": "96df43af-c86e-4e64-b028-b6fd22d25fe5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124396, "uuid": "3c393935-3297-424f-bdc8-ac0c5f5938ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124396, "uuid": "49eeefce-bfdc-461e-969f-32e8ebb96ff4", "value": "363b1b0b70ce7fcbcc08782ce18a2fe0567bd5c224f2b3c543079195baf1ee11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "372f4863-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114087, "uuid": "be381e8f-1bcd-481e-b817-d406d97a8d04", "comment": "Malware payload (Dridex)", "value": "96e2bbcbbea762d42eff789fab640db5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114087, "uuid": "efa84bdc-1613-464a-8718-31c2b615eaa7", "comment": "Malware payload (Dridex)", "value": "3679b14ab7c553a8c87f632f7011ffc6ba187d55de4b5652f433ecf487398414", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114087, "uuid": "2c16dc6d-9e92-490d-8f70-ffef0610af12", "comment": "Malware payload (Dridex)", "value": "1f0afc985abeb62ab384726b6a115d5007d9222f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114087, "uuid": "03427c82-ccc1-47fb-93d8-899ae04f5e0b", "comment": "Malware payload (Dridex)", "value": "5d429e0d78f68054c49ede5aafc052bcad3149ce1ba1dafc609b8328396c49050ff478b22529ee78a824e1ee6b89f274", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114087, "uuid": "7d339b81-f0fd-4515-be03-58798255921d", "value": "1014BE2DE333D495FFF7CAF41492AA2A8A7B2D40822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114087, "uuid": "85d60746-f3a8-4b28-8757-55d63ef6d720", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114087, "uuid": "8b5210bc-951d-40e7-8216-048cf47b7d97", "value": "3072:u3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:KJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114087, "uuid": "a4abc529-2cd2-4b65-b7e6-e235fe37f6d5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114087, "uuid": "6f3c166c-a326-4e3f-a3f3-961af7707137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114087, "uuid": "547ad742-500d-4241-b072-d875724dc32a", "value": "3679b14ab7c553a8c87f632f7011ffc6ba187d55de4b5652f433ecf487398414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45938277-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114970, "uuid": "8bd09619-4472-479a-8b27-f878988b1f82", "comment": "Malware payload (Dridex)", "value": "cc9dd0cff8af7d3c6b3dea1f1421d16f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114970, "uuid": "629a07f3-034e-412e-98ee-588046d2ef68", "comment": "Malware payload (Dridex)", "value": "36fbca076ac48cad8961bf023ebbc6f453aae1df41cf801f4b392b629447f06c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114970, "uuid": "d1ccdef3-2909-4e2a-89cc-080394c08fe8", "comment": "Malware payload (Dridex)", "value": "32971b4341ca5855a3e091b3fe0f8b20f39472a8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114970, "uuid": "66dc5d9c-821a-4714-a854-12bc4b8ade64", "comment": "Malware payload (Dridex)", "value": "07d5929777c49625b16b17188f38d50f9b8ec60acb48d4e8940d496d44cc2434992e2112ba5b7d13381e99d53b6147ae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114970, "uuid": "448e1e6a-1b34-4a01-8ae2-ef603d10cb48", "value": "9914BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114970, "uuid": "0935cd25-e024-4063-ab73-a7d54dcddda0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114970, "uuid": "f185e113-07a4-4c27-86f1-36eee4af97bb", "value": "3072:R3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:JJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114970, "uuid": "de5669bc-fbaa-45b0-b8df-799efc145ce5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114970, "uuid": "892d4ce8-b2b8-40ee-8642-c8c4f99a44c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114970, "uuid": "7232c8ef-1386-4947-a2b3-0a2468525539", "value": "36fbca076ac48cad8961bf023ebbc6f453aae1df41cf801f4b392b629447f06c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49507c29-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115406, "uuid": "f8ee3fae-4f2a-4cdd-b9a8-c12969a7f07a", "comment": "Malware payload (Dridex)", "value": "4786e8757db6d9fd816d3e944f246819", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115406, "uuid": "001f8c9d-0a27-4472-b983-5062e087190f", "comment": "Malware payload (Dridex)", "value": "373712ad06ca718db60fc7e3c74d99d1457f851805cadac7e5e50c138637ffcc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115406, "uuid": "c94b8a98-79e1-4c6e-a5b6-3c94bf63a4e4", "comment": "Malware payload (Dridex)", "value": "d20f463328b130a03ef6513a8bf62b2117648eff", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115406, "uuid": "2575f9a1-7fd7-4fca-afb3-89d5497e0e13", "comment": "Malware payload (Dridex)", "value": "341c01127ac16ef872553e584618609f32162d6c0e2a168e4ca6f6e2538c80587187dfb2318dcc672e194e5b721b07d5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115406, "uuid": "62682811-98c8-4cfe-9bd2-ed517e7d6a18", "value": "9E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115406, "uuid": "c81cac58-0409-477d-826d-3647af6bea19", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115406, "uuid": "5aaa0eaa-c109-4013-9f03-a1c532e029f9", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115406, "uuid": "2a6bd5b2-5d13-4de6-b145-361978219c11", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115406, "uuid": "35980b85-ddac-4094-8e23-50d39ade7a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115406, "uuid": "c0bb9c0f-79ac-4a2f-9868-082e08ca24a7", "value": "373712ad06ca718db60fc7e3c74d99d1457f851805cadac7e5e50c138637ffcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a372fb1-9106-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617074310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074310, "uuid": "5bd62bb3-2bf3-4cd6-bd85-63145016bc91", "comment": "Malware payload (Dridex)", "value": "2ea9d993e34623151f31fe181d25fba0", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074310, "uuid": "f43c4fcb-a345-425f-9324-936b6c473a9e", "comment": "Malware payload (Dridex)", "value": "3751ee8ad1a8cdd81aebca9b1d3a6d7e9da1cf03b9504f7849dfbeb260624c6e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074310, "uuid": "829c4d73-8be2-4951-8081-4c8fe2c0d979", "comment": "Malware payload (Dridex)", "value": "ca3cd48e56c03579ffe629cf43cdb17a20fcc0a2", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074310, "uuid": "610b7610-72e7-422f-9044-1a3c78095471", "comment": "Malware payload (Dridex)", "value": "b23fb9deebbe81a2d086dad28d759b2f598c8b1f5d5f7586baa291088d1f02af149624c3d699ef256461ad304314f3f6", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074310, "uuid": "ff4ce209-2eea-4e90-8ea7-38240d95f767", "value": "77C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074310, "uuid": "7d4ad5fc-e658-424c-b856-4cc77fba23d9", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074310, "uuid": "2bfc541f-5377-4870-8ec0-4d15466d30df", "value": "6144:eGiMOQpsduhD3AZHC/uNbExd+4Buwv1b0717WLmw6Xg6DqaIDnnlvghA5la:PVhDQZHC/uNY//vRm8LYQOQlYal", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074310, "uuid": "e13a81ff-e37b-4205-af23-00c48539d478", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074310, "uuid": "6987db00-e444-4df6-baf0-0339a4f3efd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074310, "uuid": "3b15e6b3-0585-49ea-8e08-c55ea7546d2a", "value": "3751ee8ad1a8cdd81aebca9b1d3a6d7e9da1cf03b9504f7849dfbeb260624c6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba2ed60-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114095, "uuid": "116b6aeb-f22b-4f54-9379-f991dcaf10d5", "comment": "Malware payload (Dridex)", "value": "36634e0c8c22671926bf50951e5f7009", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114095, "uuid": "c502fc6f-1ff0-4185-b77c-4039a813c5b9", "comment": "Malware payload (Dridex)", "value": "377ec7b3a69fe2ad0b3d5a89badbc9489f0b913c6bc4ace91cce0f5645e37aad", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114095, "uuid": "01e78a34-05b3-4dc5-90bd-45b215279777", "comment": "Malware payload (Dridex)", "value": "18b917dca4812e011757767453dbd924e607ecc9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114095, "uuid": "d0e5b1df-8c7f-4d7e-bacb-c0f960a392cb", "comment": "Malware payload (Dridex)", "value": "1907434324b56284dc9ac2da94ac51ffd41fda66f5a4f996f654623bad93b2fc3f1c8f4f2a3865c6900b95ed29f72c45", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114095, "uuid": "45142010-6341-4960-9a93-653ff8fb7e3b", "value": "C614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114095, "uuid": "44019273-15be-4720-a201-1c436d9b299b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114095, "uuid": "bbecc2ad-26b4-46ef-b19e-3ed21da03117", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114095, "uuid": "95cd4bf4-bb46-4716-a254-cb3b91689602", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114095, "uuid": "c83fd3bd-08e0-4fa6-9a44-34a45e687993", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114095, "uuid": "01ab9757-5c7f-460c-8f3e-dfdb0c5e604e", "value": "377ec7b3a69fe2ad0b3d5a89badbc9489f0b913c6bc4ace91cce0f5645e37aad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "542c1e2e-91ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617146348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146348, "uuid": "d1da6538-b092-4717-ac1f-bfab07a5afcc", "comment": "Malware payload", "value": "c6c974cbcd54ff45a365a7f09546dd1f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146348, "uuid": "748387d8-14f4-4c23-bc2c-8bca4d743c44", "comment": "Malware payload", "value": "3785756735ff2d3678f0f5cdad9063261c96da46727793c8d67f038666e360e9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146348, "uuid": "39c3b879-544a-4d49-8531-1bf3f791f720", "comment": "Malware payload", "value": "64b6ab96a5e0d56801b569ccccc87dbe12d8e3f4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146348, "uuid": "2bcd5559-62f6-4e56-a274-9ea2d87aaa04", "comment": "Malware payload", "value": "206a4c7735fcf3dad88fcead712bfc51df7d60ae9dadd24ed77a1b3185e245178105ea48dfa8637540cf0344538ca777", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146348, "uuid": "16548eeb-3aaa-4bce-ac91-fc51547aa714", "value": "6314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146348, "uuid": "ffe3857b-7ec5-40b1-878e-c6f1cc4708be", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146348, "uuid": "fd42727e-0485-4354-822b-4c915580dbb9", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617146348, "uuid": "a7fd854f-39d7-4c3b-83d4-a354da115988", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617146348, "uuid": "45119639-8ed3-4d8d-81fb-baa28d38b858", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146348, "uuid": "ad630eff-33d7-4994-a7a4-b2a4d624b1aa", "value": "3785756735ff2d3678f0f5cdad9063261c96da46727793c8d67f038666e360e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8c58d0-90f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1617066585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066585, "uuid": "ae6367b2-1bcb-4756-9b5c-227816dfb9c7", "comment": "Malware payload (Mirai)", "value": "301edd7c8c6743dc24cfa84a5b34d568", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066585, "uuid": "745e7c10-b6f7-4615-a77b-668d94ee214b", "comment": "Malware payload (Mirai)", "value": "378df341cea00d8c7838744959fab950d15ae443d14b770cfa2998ae7daf5190", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066585, "uuid": "1731f737-c051-4710-9aee-c20a40756f9c", "comment": "Malware payload (Mirai)", "value": "b1d5e019feec5be4f10c230de89a42af365ad3f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066585, "uuid": "14139b52-fa3a-4a63-a4ef-e17b9a48b20b", "comment": "Malware payload (Mirai)", "value": "928049c15997a361a2535de332e04869a2da20bed1f4310540fcf4dc08dac1f2a20dd346ac1d2faab24ce9519e5782c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066585, "uuid": "858cb9eb-5d8c-4bc3-a78d-4154073a73b6", "value": "00C21A46731D0D43D17B3EF03A3F2BD5D3AEAE9121E4E244765D9A8EC075A314182EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066585, "uuid": "9395e940-f407-4f07-9afc-311dd1a48b45", "value": "768:2NCO4TeDxBXr/chS5wTOm8ws1qeLh1mqqB8:2cOySXsOm9soeH/qB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617066585, "uuid": "0596521b-3a7e-45cc-805e-1b7a17537b0c", "value": 27636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617066585, "uuid": "12fbff3e-1099-4505-8d52-6d6f5d2300a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066585, "uuid": "4ac85469-7500-406f-a8cd-279af632f13a", "value": "SecuriteInfo.com.Linux.Mirai.BEG.19663.19984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619b767a-913a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617096549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096549, "uuid": "5ca278a0-e1c9-4ae9-8811-59bec59ef5e8", "comment": "Malware payload (AgentTesla)", "value": "205e3b46ce1121df8da53e4625fe9872", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096549, "uuid": "4cd59ee5-23c0-4ab9-b8d7-496a2510086e", "comment": "Malware payload (AgentTesla)", "value": "37a2259b9791e03125fef3ca14baa3336ca823c354a9b864944bcfe7892241e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096549, "uuid": "af7c94e7-818b-457c-b26c-3f2b01072dfa", "comment": "Malware payload (AgentTesla)", "value": "d672c2e1c2744d34fd18c65076eb03cfb62828ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096549, "uuid": "b8a6b48e-4371-4475-83d8-d493a00a3ef5", "comment": "Malware payload (AgentTesla)", "value": "9f8e7201db1731242c4e78c4dd3aa3db30d933d2a76d948ee6b04e29b35ea90f66efeae0d0e23f1d884b17801d46faea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096549, "uuid": "07d8248d-938d-45f6-acba-3c0c0995ed92", "value": "56E490A870AE405DEEB46A34F5B585821FC925321F62FF3F28E657005CA3779FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096549, "uuid": "5cd7b231-0a17-4002-8da5-899594db1a45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096549, "uuid": "96d86d9f-dcbb-433f-a2e8-c15a54b92f2a", "value": "6144:NaLlj/sCeMsaW/neR0WXSyH0ALD/Sqc1qZIe1WYWpSDSjjiI918SjYyFnKQm0umt:CUCbghWC3ALLSOeOvwjiI/8rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617096549, "uuid": "d95be636-f3ac-492a-a122-b257dbbd01ff", "value": 672256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617096549, "uuid": "8663c053-2214-49d7-b340-b006c8147150", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096549, "uuid": "e78dbacc-d086-4620-a53e-f742a354c21a", "value": "TT Swift confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7083033-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120422, "uuid": "f2ffa9d0-023e-46f9-82e9-17b1b67f42c7", "comment": "Malware payload (Dridex)", "value": "2919f1a6de93fe868ef56ade8f1018e2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120422, "uuid": "e52c14b8-6783-458d-b24a-00732a101e6e", "comment": "Malware payload (Dridex)", "value": "37c1f27ce7221ff5dd57322ae45cb563e195cfba3613dea6a3fcb7f586e3ddca", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120422, "uuid": "b8742457-2b3d-485d-b2a8-0cec46e5254a", "comment": "Malware payload (Dridex)", "value": "788ec8690d841d6392eb8794afe121c84786268d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120422, "uuid": "5c025d9c-ca88-42f4-a096-607bcffa09ec", "comment": "Malware payload (Dridex)", "value": "94b2ad03bb9a80fcd37e5be1f650bd2f3a784875086fc2bff7e5d0048a09b3f59b9edb647853ae4d1be20afa9028ca46", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120422, "uuid": "222f54b7-93ff-4d4d-a9fb-adecb678f974", "value": "1714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120422, "uuid": "50dcf778-4eda-4f72-80ac-dbef36a57ab8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120422, "uuid": "8ee0576c-3ce9-47d8-b58c-f8b1e9e52ae3", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120422, "uuid": "326ed314-d6ac-4b8f-8465-53fee7180d4c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120422, "uuid": "dc0bdf7e-29d1-47e4-8bfd-efae151cde6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120422, "uuid": "730f535f-6ffd-4cde-a080-a33f49ae73d8", "value": "37c1f27ce7221ff5dd57322ae45cb563e195cfba3613dea6a3fcb7f586e3ddca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786e7d82-919c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138678, "uuid": "b753ca20-46c4-404d-bae6-0dafb7a31065", "comment": "Malware payload", "value": "f31086dc5e99bf8c1a8930ca1dea7190", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138678, "uuid": "4f8b819b-71be-4bbb-9c3b-a37570641f13", "comment": "Malware payload", "value": "37c255d2a658c60ef901df021ff0a7c59b57d9f7121f9301a2913fbcc5458e17", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138678, "uuid": "a3670929-57d6-4c79-a994-c8f2163ce944", "comment": "Malware payload", "value": "e0cc800ffd3d777af1504b5dac0aa4c055c10f84", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138678, "uuid": "7c9f929c-2b4f-4829-b4e9-4879396435cf", "comment": "Malware payload", "value": "9d84a4c32b9589585cc3ccfa2732ca13f531cea29ce2aa48f8b4e9c4df08704a595cac0d0ad27ba35f5dddde32a2b7dc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138678, "uuid": "3c9da4e8-9ca7-4913-a1f3-c36c6b8c892b", "value": "EF14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138678, "uuid": "2b7a2e0c-b9c0-4e14-b4ca-27a9cb449372", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138678, "uuid": "8b83eeb6-90d3-4791-96af-0eed06adba84", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138678, "uuid": "e8eab840-cb4c-4d7d-911b-4f4bbc4d9941", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138678, "uuid": "c09544d3-6929-4ddc-92cc-6d3146560e7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138678, "uuid": "e9dc8baa-b9df-4bac-ac05-d2a53d5e8b6f", "value": "37c255d2a658c60ef901df021ff0a7c59b57d9f7121f9301a2913fbcc5458e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1d84fe-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617133233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133233, "uuid": "9ef69582-82e1-46b7-89a4-cb955333200c", "comment": "Malware payload", "value": "bac06e47f3445da7fe206377138fb46f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133233, "uuid": "1f27db06-773f-4bf4-901b-62c5b433b853", "comment": "Malware payload", "value": "37e82491740563879651ed227a18317b62a9b212a745c25c7678ead71c3251ed", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133233, "uuid": "cbc22559-1264-401f-b7aa-b71c176715a0", "comment": "Malware payload", "value": "d36b49a99ea371bed05dc238c1004bc59faf6364", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133233, "uuid": "de0f29dc-9069-4a8b-b690-0a78fcb9e72b", "comment": "Malware payload", "value": "b1da4ce75dd9dfe59f796f2cb6dc55e5131f07c5624cae40a9125847a0d6cc10b7a0389bb75ac2bd37df0313081f1a5e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133233, "uuid": "e4b1debe-b428-41bb-a64c-3b1bf92f007c", "value": "7614BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133233, "uuid": "942c9242-7536-4bd4-b5cc-1b34199e473f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133233, "uuid": "1530b6a1-a3b7-41cb-aa1e-dbf9f51bd24b", "value": "3072:R3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:JJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133233, "uuid": "86dfb5a4-09e8-455b-98de-df47ad3b17c7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133233, "uuid": "f77493c3-7090-41fc-8cda-11222f766873", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133233, "uuid": "d86ea6fa-40b7-4a78-8182-e23c609fc0ed", "value": "37e82491740563879651ed227a18317b62a9b212a745c25c7678ead71c3251ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b1fbf6-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127178, "uuid": "6650310f-b177-4219-a480-cd98e3415894", "comment": "Malware payload (IcedID)", "value": "59ead4919b2c4ad4f9d2b112cf1fc122", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127178, "uuid": "6abd3d0b-a0df-4f43-a583-7e89089523e8", "comment": "Malware payload (IcedID)", "value": "382eceafeb50aa92faf7519104dea75f5d6416b060b1175a158a0d4cce05b7f2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127178, "uuid": "c541a2d8-40f6-47a8-9f79-5876c5cc4ac7", "comment": "Malware payload (IcedID)", "value": "c290da3550f27a98e2704d94f0fec89e1c1bb4c5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127178, "uuid": "a1bba481-7f3e-4e15-b136-0c1fb0028e25", "comment": "Malware payload (IcedID)", "value": "05a5d820fb2df8453cdc8c0d6e3ae95bbc32d8d689a63ff72e0f2b5b97f6a96900ad74f0d578ef853ef46369ccaf017e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127178, "uuid": "2eabc2b2-088e-4bff-a8b0-b2a99c360011", "value": "8AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127178, "uuid": "0e1d16b4-8a92-46c2-9f74-f89cf1f08826", "value": "3072:i2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:izxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127178, "uuid": "8e1cb840-55ad-407f-a542-27b9f8309739", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127178, "uuid": "573b0ea8-7c37-4d8e-bd3f-178b4b130e6b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127178, "uuid": "b22144c8-30e7-4187-a2e5-5dd5b1a4da1f", "value": "document-1540063917.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d366b9b9-9158-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617109625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109625, "uuid": "d78087d3-123b-4aab-9ea4-83f192819238", "comment": "Malware payload (AgentTesla)", "value": "ca1092743d2c2476fe4eb6ba478fb36d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109625, "uuid": "d7ae1a13-9817-407a-94fd-e13d297858f4", "comment": "Malware payload (AgentTesla)", "value": "38787194e057adc8bb9d2f11dc4fb6083fafad8600864927ac0ee3e6c3213d95", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109625, "uuid": "5ceb6724-c65d-4a6c-ad92-1570e867de71", "comment": "Malware payload (AgentTesla)", "value": "409321c864b2eacfa3ad33eade18d2f22809887e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109625, "uuid": "a5da679a-7755-43ac-8145-51af9d7e569d", "comment": "Malware payload (AgentTesla)", "value": "b7b3872ce88db92ffd5f8cbf0dbd6596832747a187e4274f66319e27a6a283829b4ceda77d843f38a3d320d979f878b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109625, "uuid": "5d8653b3-03a2-4d38-bc1c-e197682fd3cc", "value": "B4E491A870AE005DEEB46B34F5B555821FC925321F52FF3F28E657006CA3769FA4E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109625, "uuid": "4c1c8681-8d5c-476a-865a-2e9c41cefd54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109625, "uuid": "d23c82b5-dc7e-464c-8234-a426b627a7d9", "value": "6144:iauyokqenFbRNXBdfONtGWNip2tR3V+U+q529IE41oYcWh0saIoKy5nDiZa5KQmg:+kbP3dIUsVV+rqw9qRcWh0sqnOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109625, "uuid": "f8b91c31-6e70-41c0-90ee-0cef3e990327", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109625, "uuid": "84bab1c8-8d13-4dc2-b539-3cefa08cc7e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109625, "uuid": "b89e0604-9ea8-44a1-84d4-791527865ec9", "value": "ca1092743d2c2476fe4eb6ba478fb36d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9868649-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "59d1f8eb-3bfc-4c54-ae69-493fba05111f", "comment": "Malware payload (Dridex)", "value": "caf6ef013d5e7e3faa2e3fda0618997b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "d8494437-6b81-494f-b1b4-10c79838aa4d", "comment": "Malware payload (Dridex)", "value": "395b7f1b0bf02eb671969ecc8a4ef30f6b46ea241e66c58ed0b0b4b99c6f9aa2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "ca7fbd82-1e8f-406d-9ed7-57b0a6cb20f3", "comment": "Malware payload (Dridex)", "value": "5645e27bd250c27e6157fc10703ab95c559c71b3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114306, "uuid": "a3cdefd4-9bc0-41b9-b34f-1533eaa8ac3e", "comment": "Malware payload (Dridex)", "value": "1f7613066c4cb1a39ba18e6365e9e751a9c01c8992353ef2c72a3f1d0b11d0a51c68d7cd5e6f01aba8a6e6c3ab5097f6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "f8d3d6d9-55b6-4ecf-a855-548db6181fe0", "value": "F814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "f4d8e585-8014-4f5c-8d06-7c30a98666b2", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "19eee24a-1647-4193-bcb3-19e84037d087", "value": "3072:83PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:4Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114306, "uuid": "69f82c30-de4e-44b0-8002-02b0dbeaeafe", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114306, "uuid": "ae8f436e-42e4-4668-afb2-b219520c764f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114306, "uuid": "105fed2f-9811-458a-b9b2-3be4731727c1", "value": "395b7f1b0bf02eb671969ecc8a4ef30f6b46ea241e66c58ed0b0b4b99c6f9aa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81d2bb1-9194-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135430, "uuid": "d80f3503-b2f9-4231-8347-b92efcba55c5", "comment": "Malware payload", "value": "03a09a23c1a694462e23ab6d409e0ae3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135430, "uuid": "f1cac443-0b4c-4a8e-a6d0-2c2233a9f043", "comment": "Malware payload", "value": "39647c85691d43bb0312926b3126168e3f83d2150ebc9a31ee13984bd6a1c788", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135430, "uuid": "7993106e-9da9-4ab1-853c-5e60590d4474", "comment": "Malware payload", "value": "3b83431cf91ade6656737a8cc94f8f409000c1de", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135430, "uuid": "7b465de9-9c03-4465-ad4a-2daec399b367", "comment": "Malware payload", "value": "f480c9288daf4dee7eb539a08aebcb0377630c2f5b99b765443cd9ef1d246626dd5db7f2dc674caba1db0db0d49f2e94", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135430, "uuid": "0bcd0c62-6436-4687-bd0f-f786b7da120b", "value": "C914BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135430, "uuid": "c696b02b-e445-4143-ac4e-2f882b644f6c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135430, "uuid": "63af144b-019b-4466-b750-4926fc99bb9c", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135430, "uuid": "7ed766b6-c578-462f-b800-6319132c070b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135430, "uuid": "d0860015-377e-4c5d-9ca5-640187798df3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135430, "uuid": "f27cd232-1b1b-4d38-bb83-db3261e17b0c", "value": "39647c85691d43bb0312926b3126168e3f83d2150ebc9a31ee13984bd6a1c788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2556f4-917c-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617124758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124758, "uuid": "c8c444ae-9908-43c2-8a26-2c30336f01de", "comment": "Malware payload (Dridex)", "value": "ac93ddf89895b750fbeadb7f473edfee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124758, "uuid": "4beb1647-eb6b-4fc5-a612-b0ceb7f5552a", "comment": "Malware payload (Dridex)", "value": "3a89d12af6d4c637ee98012f19c0248fe046102ad8b474829f93a9c09bd08789", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124758, "uuid": "4661df79-94a5-4074-936d-b7d987cc5da4", "comment": "Malware payload (Dridex)", "value": "7d93cd321db0bde3394a543b01b7d14e1890c206", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124758, "uuid": "9f5366c8-6f67-46f1-bd5f-45987b666afc", "comment": "Malware payload (Dridex)", "value": "eb55825b418de8181cbb788ce12ac2da94319c6d489069238eb4f5fc8914352a596dfc6544a774394e25ac7fd4f7b303", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124758, "uuid": "76ad6725-ec9a-4ff9-9fdb-7ad3a5f2d70a", "value": "EB14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124758, "uuid": "d82cf2d6-0a6f-4d29-bec8-b452288ad643", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124758, "uuid": "07c800f4-813c-40d1-b53c-119bfc682132", "value": "3072:M3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:oJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124758, "uuid": "b9a182dc-3f95-46bc-b946-8a2675fbbf9c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124758, "uuid": "1d2f26e5-f53c-449a-8488-0e1e1f5bfe95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124758, "uuid": "7872b5e5-d90e-46f4-a480-32959c873dbe", "value": "3a89d12af6d4c637ee98012f19c0248fe046102ad8b474829f93a9c09bd08789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5299bdbd-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121435, "uuid": "295dffd9-8a88-43d1-b946-53559baf9b3b", "comment": "Malware payload (Dridex)", "value": "1347bca0120517135e6f1379c2d3fd1d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121435, "uuid": "7da1b54b-0f0a-49a2-b593-d94b842c6813", "comment": "Malware payload (Dridex)", "value": "3aafca77b435bace64387dab4b4c44aa0d14f8a1053f77b327457c296e74cdb6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121435, "uuid": "7bb35213-1d58-454b-b73c-31a3eab7d315", "comment": "Malware payload (Dridex)", "value": "77023ada2be517a3b00c17e311b73d9f7267cb11", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121435, "uuid": "0df5a7ee-dfe7-48d8-a8e5-9cb3e7ecfb7c", "comment": "Malware payload (Dridex)", "value": "e43b496a5a289a78730120f2af6c79850c90a9063f11032c936f68efc6a38880a05b13aa6bcda559951cdfd9b03038d0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121435, "uuid": "42e21ba6-c45c-43f9-a6e9-c28f050c3eca", "value": "7414BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121435, "uuid": "d9f36d96-db18-4a2f-8441-0309eca1bdb8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121435, "uuid": "77e0adee-58d2-477d-9a9f-8b5ca852156d", "value": "3072:/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121435, "uuid": "d0b7e56f-3f18-4951-bdba-773ff5492364", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121435, "uuid": "ead3a6cf-9cf6-42e1-b83e-2bb872063e2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121435, "uuid": "5039af59-09c7-4d9c-8633-09aca74b360a", "value": "3aafca77b435bace64387dab4b4c44aa0d14f8a1053f77b327457c296e74cdb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6c2f79-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115309, "uuid": "b96ac534-46bc-41dc-9f4b-768aa91d9410", "comment": "Malware payload (Dridex)", "value": "bd0f48812dc93d0f02431e8d0715d6c8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115309, "uuid": "10dfd90e-65c1-45dd-9f19-b884df1a67e6", "comment": "Malware payload (Dridex)", "value": "3b6b0f23582cc5fdb9c8a6fea15f58cf4a7320de8bdfd8cca6e8e4dacbb049fe", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115309, "uuid": "e005dae8-1c65-4212-9960-eca55652474a", "comment": "Malware payload (Dridex)", "value": "bc770551062cbc69e02a0bf95ddeae0d8f3ca006", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115309, "uuid": "3159a010-2141-4621-9cce-7a7ce10326ed", "comment": "Malware payload (Dridex)", "value": "f88636932efd38ee648b5b51b897f772421deeb056adc0fcc618c339511a28691d4011afef0b432583d319bd642437d1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115309, "uuid": "3129bc76-dd4a-43a1-946d-3514f792b0c4", "value": "4D14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115309, "uuid": "404153de-75d4-45cf-99c3-ae65cb909fa5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115309, "uuid": "9e3f5353-7da1-4923-8298-1c95b9cf8ce2", "value": "3072:63PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:+Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115309, "uuid": "19ea193d-6bb8-40af-a9bc-fb497b8f6de2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115309, "uuid": "add4b8c3-13c5-4c25-b645-50d1bc884ceb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115309, "uuid": "7ad5c991-b022-459a-8711-7975140bebe9", "value": "3b6b0f23582cc5fdb9c8a6fea15f58cf4a7320de8bdfd8cca6e8e4dacbb049fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d80fe69-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126231, "uuid": "93f9b765-381f-4bb5-b44c-0c77e6a9e467", "comment": "Malware payload (IcedID)", "value": "1e9bc1ff63c12158b82dbc7a904e4d8c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126231, "uuid": "2f227fe0-7644-4bf1-bc04-b226d4223d72", "comment": "Malware payload (IcedID)", "value": "3b7abcb54165d757ee3a8c3ff7649e471ffa8e33f702138d197d28f0ab4467cf", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126231, "uuid": "5ef1b004-3baf-4e76-a1ad-57fb3859ab8f", "comment": "Malware payload (IcedID)", "value": "2fed4206c0ab283d70bd9ee29fdc0b338407bd27", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126231, "uuid": "2a93ca7f-3f1f-4095-85b9-4dcefb5a973c", "comment": "Malware payload (IcedID)", "value": "6f225d31957a087beac571427a194333e0e3bcb7e8fe0f9732f4dc4c9c40931a6399e0f3e70403b166329529a7ddea74", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126231, "uuid": "c7457274-1cba-4ac6-8f64-8befcca9328f", "value": "20B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126231, "uuid": "2b2a00ad-2b42-4d72-aaef-6b3a4be68bc7", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126231, "uuid": "2fa3e8ca-6653-473e-8d56-2e1420d311c7", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126231, "uuid": "cf384227-4b19-4287-a555-6a9de286b67b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126231, "uuid": "7d4c7cd8-15a0-4d87-8cd7-4697dc2ab1db", "value": "document-1224473545.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55efff38-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121870, "uuid": "f0f8ce18-efa9-4b12-b221-aaa3ce284b42", "comment": "Malware payload (Dridex)", "value": "d3abccac0eb6e202250cf105fac002b4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121870, "uuid": "95760f51-404c-4741-975f-95cfe86b35c5", "comment": "Malware payload (Dridex)", "value": "3c207053f2ded8f5bd2dea01b397747ab70d1de728daa95a6a566268b7005e2f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121870, "uuid": "4337540f-d41f-438f-987b-dabf1a36923b", "comment": "Malware payload (Dridex)", "value": "b82df7a93d081e055a07fb003de89d27774ab072", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121870, "uuid": "e7a6a604-3e10-437b-b114-63bb9ecfddc8", "comment": "Malware payload (Dridex)", "value": "e4ee8252eb7fa81c78bd67c68e985844c9e259b62bc96f546f5fd671ccde21c0d52c396ebb9d6e701657c3096f1af63f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121870, "uuid": "e12440b0-5527-4792-bf2f-5f6c938a2c5d", "value": "FD14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121870, "uuid": "c20df1ef-57fb-4f30-b701-84498e2e0a6b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121870, "uuid": "caf09d85-dbfe-4e5e-9fa7-f6ac603de492", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121870, "uuid": "87804624-1ee6-47c4-81e1-cf7d171f8936", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121870, "uuid": "9f48ce00-9774-46e1-a827-a0b09afce57d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121870, "uuid": "75615f49-081d-4414-8530-4d42e2c79acd", "value": "3c207053f2ded8f5bd2dea01b397747ab70d1de728daa95a6a566268b7005e2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de54322-91af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617146767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146767, "uuid": "cd427625-25e4-4eb2-a6b4-3ce1d893181d", "comment": "Malware payload", "value": "e4cdfea6f3c5f4d646a7fa366aa3c086", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146767, "uuid": "c094b66c-4810-4fc8-b0a3-f49e0a519829", "comment": "Malware payload", "value": "3c53f7eb3ba4cc6d761c74a4717b6626069790ddaa8aa0aa7e206c48fd952acb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146767, "uuid": "0c706e24-aee1-4373-bb49-bcfd77cbb121", "comment": "Malware payload", "value": "7c08d86ccc1535bc6b1558bbbf6b3f7af359474f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146767, "uuid": "76c71a96-41d0-4625-8e90-646abcd2c53d", "comment": "Malware payload", "value": "3f087190d6fb37951ff4ba540003f7327305cabbf846f90ef0b013f543166ebd34dd4f1afb095061c0e541a0e2c16df0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146767, "uuid": "a5c5c15e-80cb-400f-8e52-7df3d58f070f", "value": "6B14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146767, "uuid": "a7b0988b-9c4b-4409-947d-da6765251ae2", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146767, "uuid": "d10e4e8e-2643-4f2a-a6cb-5428f38e733c", "value": "3072:I3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:sJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617146767, "uuid": "20af60fc-6ebb-403d-aae6-b360e45e1968", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617146767, "uuid": "bcd26b94-d532-4988-bc62-c8a7fb92e197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146767, "uuid": "7c593ddf-b19f-4b3a-886c-b3d65c73d105", "value": "3c53f7eb3ba4cc6d761c74a4717b6626069790ddaa8aa0aa7e206c48fd952acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508b9bfc-919c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138611, "uuid": "bc297118-f4b8-4ec7-9b3a-05eb635f37c5", "comment": "Malware payload", "value": "7c3608b1b536d4a777dbdce9ad293bc3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138611, "uuid": "e4b5126b-d8e1-4b37-bb2e-8cb0c1f03cd2", "comment": "Malware payload", "value": "3c5906129f961049d55e3010f3c350f4a0e63da2b1aac27a0c87136d405c9f4a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138611, "uuid": "6e029922-ef93-40c9-8f75-0d47f180fb9b", "comment": "Malware payload", "value": "5f8618d8cc55f0f75648fb8e0af709ead934a874", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138611, "uuid": "11124480-06f2-40d5-902b-813948309c95", "comment": "Malware payload", "value": "a4e2f6a946403082885ef2dfcc9251c8dae1191a6b0b6470d2fa25326b866b0b3d21eebd2eb0379091e9e56b9f22256d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138611, "uuid": "05240611-34a4-4251-b8bd-d6988a73e322", "value": "2814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138611, "uuid": "6e23a52f-06cf-4874-b8e1-86a773ad244b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138611, "uuid": "0b6b7679-abac-46b1-b67f-b0bf9729aecc", "value": "3072:r3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:rJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138611, "uuid": "8de6baaf-6be2-446b-89ae-6db6ddc6f603", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138611, "uuid": "c8425d66-873e-4ffb-8e1d-499cdecedb16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138611, "uuid": "360b395e-445b-4208-9d27-809359c53f36", "value": "3c5906129f961049d55e3010f3c350f4a0e63da2b1aac27a0c87136d405c9f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c78381-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106676, "uuid": "ae438971-ff40-4e0d-b441-ec8c2328bb47", "comment": "Malware payload (Formbook)", "value": "7afe140cbd5211e606db688742674627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106676, "uuid": "86492ffa-d6e8-4125-86ee-8892030868bc", "comment": "Malware payload (Formbook)", "value": "3c5cf190ba17e8138feadf46a81dbdafff69ecd8b9122aaf4967fbd9aa79c1f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106676, "uuid": "00db77fe-eb2e-4d46-8573-4d895fbf1220", "comment": "Malware payload (Formbook)", "value": "3a0276463531477b0cb865d51b403313c3b0a416", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106676, "uuid": "2bfade2e-9e54-4f8e-a1ed-275099549ca1", "comment": "Malware payload (Formbook)", "value": "9b3abfd176c5e321bd3d3654be0a81537a53b7c1db2794be2ffd14a08df5f2761c14a81cbaa9d15139003ccbb65399e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106676, "uuid": "9c0fffc7-744a-4ebc-ab94-5d136c6c7833", "value": "E024129E52E19477C96E08B300F2CA24F13EF35D33054A47AB152BBD7C673AA1D2915D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106676, "uuid": "921ac210-cd25-4678-8410-67da48c433eb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106676, "uuid": "42047c40-3594-4d8e-a52b-f94cbfa9d9d2", "value": "3072:nTs3BxJNmJkKawnK4lc9Xhz6HwHRWNBxmV6v7jDIo6JSoMVNnJs18grng/wWopKB:nAPYKNuQ4N7mGjEaoIutWopx26c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106676, "uuid": "1cf9a1d8-63d5-4808-ba8d-5a169a650049", "value": 229950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106676, "uuid": "cfecc32e-7696-4a71-acd7-4e563c47968e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106676, "uuid": "7503f935-b4b1-4d60-bd0a-3e72582e1190", "value": "Bista_094924,ppdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d009e80-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108648, "uuid": "82def47e-1fc9-4af3-a379-747ce9365f82", "comment": "Malware payload (Quakbot)", "value": "251838c33724403230f2afde5adef616", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108648, "uuid": "0ad939f3-0673-4454-9df4-62669ce94b40", "comment": "Malware payload (Quakbot)", "value": "3c8d855aa728cb57d1c99d1e8c1002bcc0461be793ba065d0ba6d95b4d847007", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108648, "uuid": "a7d8a06a-fc1f-4c9d-92f0-759ced855da6", "comment": "Malware payload (Quakbot)", "value": "900e3ce2e93567ae61ad0bec62b2bf3cace78165", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108648, "uuid": "fe314753-724d-4561-b756-d0fe28ebe705", "comment": "Malware payload (Quakbot)", "value": "2557ce4f700778f312c5081e4730c362063db2a114d436c084570016113a29a782b8b788adb04c338cf3732854d551ca", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108648, "uuid": "059b157e-f9e3-4c8c-a11e-73ee9156f200", "value": "70A3E04E7280B90FC78FF93E9946A8FA18630041D626E53F35F97B0C55692870F5A9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108648, "uuid": "7d34a56b-6e7a-4cc4-8931-baa139c4281a", "value": "3072:UYjk93UIzkS1fwFTdV/vEQSlcCQMeNOEM:UpR5wRd7ucCQMekn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108648, "uuid": "0754725d-6f6d-414d-9887-2c80999e4004", "value": 103661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108648, "uuid": "bcafd73a-e6e6-47f3-a947-a093a9576aaa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108648, "uuid": "d348b586-cf4e-445e-9418-2d8523b7107b", "value": "licenza_1109.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c81bc22-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123196, "uuid": "9f3e16a3-1465-4733-8269-f41484aa696c", "comment": "Malware payload (Dridex)", "value": "256c299529b70e05858cc8aeff690210", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123196, "uuid": "5c2b4f7e-b55d-4018-a325-21fe793a8b0f", "comment": "Malware payload (Dridex)", "value": "3d230112dca28b819f99b3225095cc60b76838a1d36e1431de6fff0f9db7cff8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123196, "uuid": "1db55367-9ebc-44af-91b0-9eaa20a1fe6c", "comment": "Malware payload (Dridex)", "value": "ddadd801afc6fa1f246a7cce64670ee2fc654571", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123196, "uuid": "3eff7c02-a61e-4a04-bc0b-cee31d9d988e", "comment": "Malware payload (Dridex)", "value": "a1c9525c390dd204b63a95959a0f10cf3eb5e3ab320fc303518ac5a846677a09be4a8c078eba98e6e62425a2c0a76a75", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123196, "uuid": "d35436b4-9be6-4f72-86ad-78c0d007e13b", "value": "F814BE2DE333D495FFF7CAF41492AA2A8A7B2D40821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123196, "uuid": "794f6883-66b5-4928-b5ef-0c2c99143a54", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123196, "uuid": "702f460b-93d1-40a3-9509-8a314993f89d", "value": "3072:03PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:wJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123196, "uuid": "060acae7-cec2-4af4-b70a-6f3228e403a5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123196, "uuid": "beb4652c-6cc2-408f-9d38-d4c40d2371e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123196, "uuid": "d8512316-4d6d-4c4c-a324-f17e736e8d83", "value": "3d230112dca28b819f99b3225095cc60b76838a1d36e1431de6fff0f9db7cff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e7a30be-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114959, "uuid": "6deb546c-12d9-47c6-b1df-38e396c0c51a", "comment": "Malware payload (Dridex)", "value": "037c2cfe1fa72e0257be0a4c1f016bd7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114959, "uuid": "41debcb2-c37b-488f-89fc-49219552e36c", "comment": "Malware payload (Dridex)", "value": "3d626c3d7446fb5058136d6cfab9d7b7bd9e3c0e7fb171a3d3aa3f5779f33ad8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114959, "uuid": "c4b5081c-2637-4229-ba47-59b9b0ba047f", "comment": "Malware payload (Dridex)", "value": "c38c42837de35ad6192c1a4e016a3ccfd9e7e184", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114959, "uuid": "e4f7b666-25f3-42a8-b200-37b2964f779c", "comment": "Malware payload (Dridex)", "value": "c73428c826b58066d57d38da5839e9e2d868f79cebecbb35449963e8618afe55428440b14a59e52dc10c4b8861193d92", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114959, "uuid": "213e3015-9fc1-469b-9dda-4b341424107b", "value": "8614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114959, "uuid": "189cff30-0e3c-41b9-9ba6-50288799fbf3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114959, "uuid": "a5529186-ce5e-4d03-905b-92e4a64cc810", "value": "3072:N3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:tJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114959, "uuid": "3a028c78-78a6-4a76-8291-8114f841675a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114959, "uuid": "17bb7f87-1594-43e7-9ca4-3fe34d418a4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114959, "uuid": "d3bd14d9-603a-4d9e-818a-abab1a068f6f", "value": "3d626c3d7446fb5058136d6cfab9d7b7bd9e3c0e7fb171a3d3aa3f5779f33ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1f43ae7-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120709, "uuid": "f53e4022-67de-47d2-b96f-b4202233e58e", "comment": "Malware payload (IcedID)", "value": "8f13a6e9a16114ef64a6f106b000758d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120709, "uuid": "52d12699-c675-45fd-83bb-27cb89c276db", "comment": "Malware payload (IcedID)", "value": "3d8c6b24e1db1e20cfb342f4f3d4ec631fe1e0970c4bcc4352392f4a9c3f70c1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120709, "uuid": "971d41f6-3067-45ad-b00d-f7eab0f9b330", "comment": "Malware payload (IcedID)", "value": "e5881fae5afdf23149691268eba8a4afe2dec641", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120709, "uuid": "acbef4da-e368-424c-bb71-5636d0b83bd8", "comment": "Malware payload (IcedID)", "value": "f4ba8fcf29e0f42e8870cba5bc7046d5241d23dd89f9601125cde29021e65a00dadffd82b95f538ac758477886ec377f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120709, "uuid": "8cb902e2-c230-4f40-8c0d-32c5a69efb89", "value": "4DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120709, "uuid": "d28d75ef-0149-440f-a566-7ced9c1399fd", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120709, "uuid": "c94fdf7a-39e8-420f-8ab5-6179dc0cb4f0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120709, "uuid": "6a4f5a3c-3fb1-4e81-9cb0-6d448e8eb260", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120709, "uuid": "ebe9b04a-5f8d-4a49-bbfe-4bb913e107c3", "value": "document-612697478.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff8cb65-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617137429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137429, "uuid": "e0c5d88d-dc55-4b2c-addc-e37ee808f802", "comment": "Malware payload (AgentTesla)", "value": "0605696b1b52ffebe1fd0d3c1bfc0bec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137429, "uuid": "5a906ab1-0a61-4cb3-9df4-c0d3fd226eb1", "comment": "Malware payload (AgentTesla)", "value": "3d8f71d1e009a04ceb350dc6d2d4026cde866c67aa1466957e67d5b2021f431d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137429, "uuid": "eaf993ce-031c-4e48-b377-bff83bd15244", "comment": "Malware payload (AgentTesla)", "value": "33641ee64ed863196feae55d3b2af0e843b917ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137429, "uuid": "3a461686-b448-4ace-bd40-d26878ac7a32", "comment": "Malware payload (AgentTesla)", "value": "99246ba5442f912ea7cd57d5353e2266f84cf4c9235a234493aabff9a3dd8356fe1719a8670e6f560e1189b0141bd72d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137429, "uuid": "83791e0b-3ba3-4dd2-b30a-125d6a5ebe79", "value": "FFE4B4A870AE805DEEB46634F5B555821FC959321F62FF3F28E66B002C63779F94E810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137429, "uuid": "3f938586-4db7-4b94-a766-9ce0424debbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137429, "uuid": "35eda59e-dc62-450b-bad6-ec56973dc5d9", "value": "12288:H+BAVZHLIyEDNQzfVaB4QBRE1LqQWvexjGXp/B98MNV:66qyZ+pwLp5Wh3JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137429, "uuid": "68030ad0-db3f-4dc0-a6dc-922049b19417", "value": 674304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137429, "uuid": "b97370fa-134a-47aa-92a3-3f30ed57fdce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137429, "uuid": "b8f5262a-1ba6-4750-b85a-b4c9c7da5517", "value": "0xGszPZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9203923-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108776, "uuid": "5032c46c-54ec-4d03-acfc-d4b4415593bb", "comment": "Malware payload (Quakbot)", "value": "5381440935d774635cd12a46edbf94ff", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108776, "uuid": "7e8348e3-685b-46ab-acfb-374683b85217", "comment": "Malware payload (Quakbot)", "value": "3dd0729627f26c644f073aa160662dcbe114d6d78874ae7629d1894d6148bf42", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108776, "uuid": "6c8fb00f-4deb-4102-bf17-fbf88746298b", "comment": "Malware payload (Quakbot)", "value": "f4fe40b0590483140c36c7fd5a4d64e9eab1a250", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108776, "uuid": "c7a64bf9-e55f-44fe-9cb4-012242d2e3c8", "comment": "Malware payload (Quakbot)", "value": "0b79c796368f9fca83a5108dd2d18625b6663917f98c8d3328146e294d5b94773b0d0a4eaf32d3673931a3a156b025ed", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108776, "uuid": "b9dd92d5-7780-4853-9a4e-5a02ec6640a7", "value": "FFC3CF8EB284A91EC36F783D8682A8D31D461046A557B13F36F4BF09A5E91D31F5F18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108776, "uuid": "141b9eca-21db-4b4a-aea2-049c57942940", "value": "3072:OVAfGEyimGTdV/vEQSlcCq5wsXrIKRPDpv:uTORd7ucC+wsXVRP9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108776, "uuid": "ccbbbeac-7d68-4057-9fd5-95cf53d81ef9", "value": 121472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108776, "uuid": "9515d87f-47d5-48f8-8a27-091400f98844", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108776, "uuid": "00859de7-0057-49c3-a6ac-2ef80ffb9dbe", "value": "lista_1955.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391ad371-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122681, "uuid": "22809f14-0670-437c-ba35-89e0b77bab44", "comment": "Malware payload (Dridex)", "value": "572df8e6eab1cc828bcfa2f4027d61f9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122681, "uuid": "60897296-6808-449f-a883-847b29c6b2c7", "comment": "Malware payload (Dridex)", "value": "3e13b118ecb5deab6417306f818732207292c3c7a0be75308b879e014f570b28", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122681, "uuid": "06a7eab8-9448-49ec-b74e-14780581a276", "comment": "Malware payload (Dridex)", "value": "4f62c583f996713e392dde6e19502dcf654f8e8e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122681, "uuid": "3a00ebec-20e6-48b8-b85e-3e2a2c1fabe4", "comment": "Malware payload (Dridex)", "value": "3c4d32a0f92b2b09714742b99b3fc5e033f61d4b310d71933f7c8b124f23670c738352049ed09398f956a18b6ec5ee7a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122681, "uuid": "3ab071b6-0367-4cfa-b12e-cbace1b77351", "value": "AD14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122681, "uuid": "7f8f3177-bb28-4d52-b042-9fb0b4dfca99", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122681, "uuid": "4c44281e-524d-4eef-b59d-9fe6048204ae", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122681, "uuid": "a8ad1165-e15d-4c9a-929d-8a1e9402b47c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122681, "uuid": "91f56efe-8dd5-4752-a776-c84ca1331c50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122681, "uuid": "f20105d5-9529-4eb7-8fd7-4e7b447cf188", "value": "3e13b118ecb5deab6417306f818732207292c3c7a0be75308b879e014f570b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9b887e-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121477, "uuid": "5a0355b9-766e-4556-9f98-8b036aa7a616", "comment": "Malware payload (Dridex)", "value": "0ce586ab95b8428422123d927d5703ea", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121477, "uuid": "bfcc0516-ff58-48fd-be36-83abb3ab5e0f", "comment": "Malware payload (Dridex)", "value": "3e88556a7edeedbc3e279209dbb7a610c8af42033ef7a6badabc18284ce28c0a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121477, "uuid": "d3166a58-5cb5-48de-a292-475d01674daf", "comment": "Malware payload (Dridex)", "value": "25d06f52adcc51dd623b4815e1466959f41aa986", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121477, "uuid": "84e9511c-937f-4abd-982a-63b6e29518f2", "comment": "Malware payload (Dridex)", "value": "429cbb2ae424572454ae0389221539eb34d98acc99d9f12a875d124c2b83d16741b5a214527dbdeb899032b1e4560948", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121477, "uuid": "7bf53884-c577-4b51-971e-303d3ce87e1d", "value": "2D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121477, "uuid": "5fcf6195-2bc6-4599-bee4-14d47646ff86", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121477, "uuid": "fba8da6c-98ee-44d2-a109-042dea7e03e9", "value": "3072:x3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:pJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121477, "uuid": "055af547-9149-4675-991d-15b7426f9198", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121477, "uuid": "8f0effc4-3cef-4c03-a227-e0639db0ae4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121477, "uuid": "a5438ecd-186d-4d6a-b4c5-8348007106ad", "value": "3e88556a7edeedbc3e279209dbb7a610c8af42033ef7a6badabc18284ce28c0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d342a2f-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114956, "uuid": "53e148d9-a60e-4467-afd5-28c0b7c37f52", "comment": "Malware payload (Dridex)", "value": "c69f4746ab3814724d8bbb419b72a90f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114956, "uuid": "39372be0-a2d7-400c-aedb-14f141395e7d", "comment": "Malware payload (Dridex)", "value": "3e95a37274ce2c09a8cc1275250260b99b2cd09387dc83596758e4c343bb6416", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114956, "uuid": "d47a9ee6-e3ea-405b-a11f-359b0aab7d73", "comment": "Malware payload (Dridex)", "value": "a16bab93d5d41606e3d0832fa3fb4dd42e803373", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114956, "uuid": "138a4988-6645-4d96-98e4-10e99bfac139", "comment": "Malware payload (Dridex)", "value": "3cb0e0ef4bf80a867ca2d09ab80ba5e5c3782da1c43d44fdadef5ec4deeeacc749f5929347dfe71b59377948e2737bb8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114956, "uuid": "953a2d69-5dd8-4cc2-a235-174ed1de43af", "value": "7314BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114956, "uuid": "e4e3fa64-3271-43bf-bdd0-e935b4df3da7", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114956, "uuid": "565d58c6-1ee6-4a2f-8731-622dfd145e60", "value": "3072:43PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:8Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114956, "uuid": "45629811-8529-48cc-b419-ba8bc93ed40c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114956, "uuid": "1af505d6-8c01-4f7b-a3ce-5eb9f49677bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114956, "uuid": "a99219bf-c5e8-4f11-9e75-42065a8a34fa", "value": "3e95a37274ce2c09a8cc1275250260b99b2cd09387dc83596758e4c343bb6416", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbffa3c-918a-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617130798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130798, "uuid": "5470550b-84d0-4db9-af1f-253cb187d6be", "comment": "Malware payload", "value": "4cc69f0a1d622dc74bc312449ab73e88", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130798, "uuid": "391e3254-e9e8-4f99-b913-1cf22197676e", "comment": "Malware payload", "value": "3ebbf303fe86300fb296d5c7e714c1d1447bcc3f26f142fed493ba091d422075", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130798, "uuid": "594c1e77-1ff3-4dd5-b796-e61359334ff9", "comment": "Malware payload", "value": "94c3cf189e82a901f5224677fb529823ebdf8c8c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130798, "uuid": "13165ad2-f2df-4e35-b909-8b85657f7404", "comment": "Malware payload", "value": "dfda2e19274ed8eee71e64c2274c6ada33609d624cf4b59beee81620ca766e2a8e57bd3bb227ade283b69827505f3163", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130798, "uuid": "5d258888-94ac-4269-8a38-77b2e52fa131", "value": "72B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130798, "uuid": "3181351a-efed-4728-9250-6a2853bc4eb4", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617130798, "uuid": "e379f6ec-fa37-4639-be78-230f38e102df", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617130798, "uuid": "b4473bfe-c74d-4290-a3f1-bdfc0b2090ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130798, "uuid": "77008b5a-e1d1-4696-bd42-ecb3308a87b2", "value": "document-2142566686.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f017a85-90f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (Mirai)", "timestamp": 1617066587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066587, "uuid": "2ae3101f-9ace-41b5-b4cb-3a7be9db7f41", "comment": "Malware payload (Mirai)", "value": "16c9284da43fde7ffd1d4ab341a9f0cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066587, "uuid": "08d899a9-d97d-4924-916e-dc2340e66e23", "comment": "Malware payload (Mirai)", "value": "3ef73e98076dc49d83f733eceab93dcffeeefdbdf6f0a36bef756d3448b5d9dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066587, "uuid": "c30c0828-aab3-4988-8e86-afa0673d58d7", "comment": "Malware payload (Mirai)", "value": "8ea5fcfb20a4116e4131fc3b6703148c17ebf289", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066587, "uuid": "cc2204bf-71bd-4fa2-8447-d8f867e48146", "comment": "Malware payload (Mirai)", "value": "590d39d8a5d0561c974cdd79fba0eb31f7e973e8e36bc5351833361f69c3a9fc8c7efe8ac41349693da3b7349c04e0ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066587, "uuid": "4984be99-8b43-43ce-8f32-d98201b19fb5", "value": "A4F2A406AF654F67DC6FDD734AAD0B4630CCA44B12A83B3A3574D928F34A54B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066587, "uuid": "ef1b6cff-d311-4e0d-a801-246c73aa38a4", "value": "768:kCcG52hilxafjeFeJej+b42Z9u/eXifCZ0fO6upnmNe:kCco2hilxabUAPVZ90+Z0fOqNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617066587, "uuid": "3aac4900-85f3-4aed-aa37-b886b32d2b51", "value": 36608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617066587, "uuid": "018b9c4c-ed7e-4a0d-b293-791b8a731d95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066587, "uuid": "96a33923-1ab1-49db-bee2-e1e39c0211c4", "value": "SecuriteInfo.com.Linux.Mirai.BEG.30603.25433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edf354f-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120274, "uuid": "8a6e6362-7129-4529-9287-e7df4c6da174", "comment": "Malware payload (Dridex)", "value": "06fa5938da2329e6e764172ce004dc11", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120274, "uuid": "dd6a1244-5e0c-459d-a5fe-bf78649af5b4", "comment": "Malware payload (Dridex)", "value": "3f23bd0e0369d5a47a7bea958fd229cda5f58862c3fef86438b4acaabe095de9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120274, "uuid": "07d8883e-6836-49c6-8234-239dc00cfcc3", "comment": "Malware payload (Dridex)", "value": "847731532761ff11a5bc5a2c7a10d4049450ea88", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120274, "uuid": "e79b6aae-6ca5-4b1b-9430-09ca3224e0ca", "comment": "Malware payload (Dridex)", "value": "6eeef42f7d2fc0c27f2e8d905966f236e1a8b6405036fb62fe929e9e395c437d86654a58821ed79dbbc063245251eb71", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120274, "uuid": "d1c74931-63a7-409a-ab29-7242b1dd4ef0", "value": "D814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120274, "uuid": "4f5eec14-5428-48b3-b672-3640f05dcdbe", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120274, "uuid": "af0a2008-a22d-4dfc-814b-5a58929a51ae", "value": "3072:L3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:LJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120274, "uuid": "63aebdd2-64ad-4239-94e1-c6bc3846a520", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120274, "uuid": "e2a88307-72e0-4153-8182-1b02fb6de83c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120274, "uuid": "0b255bd1-bbe8-44de-9e78-a4e8df31f239", "value": "3f23bd0e0369d5a47a7bea958fd229cda5f58862c3fef86438b4acaabe095de9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53643ad0-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115423, "uuid": "05745c02-5791-4d00-b40a-9ee77cfc599b", "comment": "Malware payload (Dridex)", "value": "e0714da7ba411309e0291383f1bca350", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115423, "uuid": "9bfcc81d-916b-4719-b52d-17c8af983628", "comment": "Malware payload (Dridex)", "value": "3f9a1be66949c2552deb6be9518cd23d9de09b527adb86585d6b012056224222", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115423, "uuid": "a6d3a017-4cdd-4a50-be86-8c49a1a45a40", "comment": "Malware payload (Dridex)", "value": "a01b80c413571a5d43556371954cf21cdcbc85ce", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115423, "uuid": "8f46def5-48b0-4c5d-a066-0a1579027145", "comment": "Malware payload (Dridex)", "value": "d925fd4e65f95c12c9f5d11b4e011f0343c0bc0cbc1d9f92e49af12bd599e2ff7cf01000ff58530f1ed08ca5ca2ae519", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115423, "uuid": "14b94fd3-cb67-4ab3-ace1-847d8feaf251", "value": "7314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115423, "uuid": "30883a31-fa42-461e-a95e-99f20a269e2d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115423, "uuid": "b5e64859-6ce3-41d1-854e-971983949348", "value": "3072:L3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:LJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115423, "uuid": "eb8d01e6-33f0-4d8e-be4c-fd92d560cc68", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115423, "uuid": "c763d772-fa4e-4364-9714-95cc1e4da0f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115423, "uuid": "4c5847cc-0c0e-4a1b-a9de-2b0c5c7bca55", "value": "3f9a1be66949c2552deb6be9518cd23d9de09b527adb86585d6b012056224222", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a6a869-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123101, "uuid": "6144dff1-f436-46f5-9820-f056a3375c86", "comment": "Malware payload (IcedID)", "value": "51729735ebe2cfd765dfb99a19d432d7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123101, "uuid": "47275963-b2cf-42e3-bf38-f5cd48a5791b", "comment": "Malware payload (IcedID)", "value": "3f9f1b70f14995bfdbe31d6f7c5bab35843ee32abfca1488d3ebaaa75018d9e5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123101, "uuid": "989022ca-6fba-4235-b7ba-f674e8e47fc2", "comment": "Malware payload (IcedID)", "value": "2c84b84630ffc25431b9086b8c94beff1e28f2b3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123101, "uuid": "6f4634e4-7e4f-445f-93ba-08c2ee2c0241", "comment": "Malware payload (IcedID)", "value": "70a6e0c24f52dd1b9f1a0ff8e9a66c6ad7af190d2524475d4137cdde859fe1600ff7200bdf7552e20723ba12e7eeba03", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123101, "uuid": "e76782a0-1cea-45e2-a7cd-f8292b9c617b", "value": "00B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123101, "uuid": "02311924-3f93-4b14-8d37-6ce9d95c0b3a", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123101, "uuid": "3108e925-0168-4789-8316-a12af5ccb218", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123101, "uuid": "6f9e3d67-5ac2-49eb-a789-0d8f79ceddeb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123101, "uuid": "74580789-3224-43c6-8cb7-6f80ac16dd79", "value": "document-2036900010.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f50b5c-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "98cbb4ce-7371-4e9f-9961-00fea8a8cacb", "comment": "Malware payload (Dridex)", "value": "2e1c9d678c8aa3bfabb07315f8cc8985", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "d2084c32-35a0-4d4c-999b-36e05b278cf9", "comment": "Malware payload (Dridex)", "value": "3fe4a7dea5e9c30d81375f81b16fae200fa06c7b954e2769cd5317dd450c8452", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "53ab8038-2b69-4e78-b5b3-74199c50ff70", "comment": "Malware payload (Dridex)", "value": "0d5c79a6d5402f2f49a6ab87c6f83b5ffb46f717", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114092, "uuid": "305f1361-d1ff-4875-9f70-ce8f7b9b85a8", "comment": "Malware payload (Dridex)", "value": "af4a6c0dbbfdad35ae022493a15df9aa390215e2e60f58e1de5285b06525ae513240aaa5c183836e03f4384401562ab2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "836b4201-bcde-49fd-8b1f-a593721b3a78", "value": "5714BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "afb9e85e-e50a-4661-94d8-0b4b8af9e4df", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "d14582d5-e422-49ae-bec5-8c0e5e7dbd26", "value": "3072:n3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:/Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114092, "uuid": "bd9bc7c6-435f-4d90-a1cd-6ff853d5dc2b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114092, "uuid": "9c15f4f4-684d-4a95-bb10-f47e0a1e479c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114092, "uuid": "62c9263d-c68b-4724-ab27-b69cc7c4c8bc", "value": "3fe4a7dea5e9c30d81375f81b16fae200fa06c7b954e2769cd5317dd450c8452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe9b15b-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115256, "uuid": "d5517eda-8f10-462a-bad1-6ba68c10f61e", "comment": "Malware payload (Dridex)", "value": "ca9c6824a4f4e1c57aec1adae6e7ea36", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115256, "uuid": "9b69882c-ca9e-4467-b087-1c308901ef6c", "comment": "Malware payload (Dridex)", "value": "400a8231747b4c98bac2ce6890ae94bbeaf9fd580f84bca4702ccd6130e47b86", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115256, "uuid": "0323c897-f592-4433-a9fa-b6010e4ac11d", "comment": "Malware payload (Dridex)", "value": "3d71f78a8bc1f13b6079303f6c47d7aa0b7f65c3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115256, "uuid": "98810824-f1a5-4ebb-83c6-78cb3878d1d2", "comment": "Malware payload (Dridex)", "value": "9219457716ed8510e7decb5f0118292057bf2072f315ae56fc4b71f96e3c2db55aed4ef7a05c4320cbac2c9e61ef41e2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115256, "uuid": "363c05d5-1f0a-40a5-b2d9-b2dfd301b917", "value": "3514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115256, "uuid": "47574db8-ca87-4b83-95a9-6a9150e2efa9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115256, "uuid": "617a657a-c50f-45ab-a089-75d21c03f8f3", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115256, "uuid": "08175a55-ca0f-42d4-aac7-ee9b3041f171", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115256, "uuid": "0352ab21-83d6-47dc-a22d-8b12d6c87996", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115256, "uuid": "8056166a-1ff7-47f8-9f1f-7b61d3d56dfa", "value": "400a8231747b4c98bac2ce6890ae94bbeaf9fd580f84bca4702ccd6130e47b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd2e26d-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121801, "uuid": "cd24775c-d30d-4bb0-964b-60e6ca36521b", "comment": "Malware payload (Dridex)", "value": "3300ea090f6378c7ec9f9fd61516c936", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121801, "uuid": "632db883-2194-452d-be89-608b9afb9886", "comment": "Malware payload (Dridex)", "value": "413ceb056a530b04fbc3f8833e87f84f8b3c6bca13dd51a30568b6061bdcab3f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121801, "uuid": "be5ceca2-4c13-4627-9ca9-0c75d911e202", "comment": "Malware payload (Dridex)", "value": "ddafc2afece54179ff58a219c4235f05de6b9a4a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121801, "uuid": "6c778b7b-824b-462c-b81a-bf56bbef8c9c", "comment": "Malware payload (Dridex)", "value": "53d09f18c2341a3d5d1595183ba91f15f27c1a4dd6d89308e6baa13fed220e35200c1caac31b865d82fb381cb7725d39", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121801, "uuid": "546290b4-7431-4589-976b-70c4532d9d9f", "value": "8414BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121801, "uuid": "d89c844c-51b7-4aa7-a9bd-f2a74bc19646", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121801, "uuid": "0f4b38b5-e76e-4c61-804c-c78ad9672c46", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121801, "uuid": "515613ce-b70b-4e27-a522-63842843434d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121801, "uuid": "395452ce-34c6-4dfc-b755-ffc2ec41b3a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121801, "uuid": "cd245845-045a-4d01-85b1-cd5afc51870b", "value": "413ceb056a530b04fbc3f8833e87f84f8b3c6bca13dd51a30568b6061bdcab3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86cc506-911e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617084669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084669, "uuid": "d1f895f4-38ee-4149-aee9-d5e5514d6af7", "comment": "Malware payload (Formbook)", "value": "5acbbd1d90454b90e2063de4ff73d3b7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084669, "uuid": "f790ed95-3c4c-4987-9d64-eb88356c0f8e", "comment": "Malware payload (Formbook)", "value": "4153ee7a17dfabd028ec717f24d07b255b26318e80412289072394ead04f7ac3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084669, "uuid": "91ab13a6-d540-4cc5-bf11-cb1b46632a85", "comment": "Malware payload (Formbook)", "value": "2aea369f6aea6e0b8adf3ff459a17e079ca789f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084669, "uuid": "d7cf3d59-6f41-4cb4-9dab-a5133623390d", "comment": "Malware payload (Formbook)", "value": "a2e044533f1795b3d3f9d61da42fe05692f6f95dd1da01a98c14dd53fc33ec5c1232b94820c8a84355571e93125b021c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084669, "uuid": "db16e207-2062-43f8-ab61-6e091e69dcc0", "value": "9DE5332EB7B7CF27D0B9A8B48565647900259E641D04D843331E3BA9F237276A3F639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084669, "uuid": "e3224fd1-068b-46b4-b843-8efa3489f1bb", "value": "49152:NSjway2BC4nU00U0vCE0DDgfqEh89rqNI1ErwIQP82fGh3ewOTFvlb7wCIwW9DNw:P2BTUEowEh89rqymclAlO7wCYmoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617084669, "uuid": "bde01535-3326-4c76-80a3-952727ae8d81", "value": 3036160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617084669, "uuid": "99432907-44e2-4db9-978b-ecb4239653b2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084669, "uuid": "3d959e48-f17c-4214-8aaf-a28d374aa69e", "value": "purchase order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb592395-9162-11eb-abe1-42010a9c0039", "comment": "Malware payload (TrickBot)", "timestamp": 1617113987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617113987, "uuid": "836365a6-f051-43ac-9fdb-7befd8a17053", "comment": "Malware payload (TrickBot)", "value": "f096f303dcdb76c3c05cd188305ca51d", "object_relation": "md5", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617113987, "uuid": "6bccb36b-fbc4-4729-a9c4-8d13a904b5a3", "comment": "Malware payload (TrickBot)", "value": "415fc862868887832ebc7a619c6d8d3f99b7e73d5ba271a7673d7af6ec0f5fcc", "object_relation": "sha256", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617113987, "uuid": "3035f15a-4dc4-487b-8a82-c830080953c5", "comment": "Malware payload (TrickBot)", "value": "39309714cbe65a221d956a0a249a85564fc88f7b", "object_relation": "sha1", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617113987, "uuid": "5db6ccf2-fe1a-41d4-9f87-d832b6bc7d74", "comment": "Malware payload (TrickBot)", "value": "01b3ac62f392d9171c1a5a9062f9a64b3b1d32adb0af426cad067042321cfe2da9b490707ba14d1e94847e56a296aba1", "object_relation": "sha3-384", "Tag": [ { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617113987, "uuid": "24ff8d8f-4735-4090-9561-13a5646b3f6f", "value": "90A4AC42FB1842A5CC97863F4D813FCAD31A4BEC2F5988BFFAAD50A14715177A44932B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617113987, "uuid": "b3a2b2ed-575e-4b63-8579-ce56f64d8691", "value": "7d35c86f856a368dd81109da3be969b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617113987, "uuid": "ea55ca33-1915-4947-9f61-74f6df52fea9", "value": "12288:33MpBABgpPMlc0AnY6I/s7cgizHcxVTLHKLwm2tJRV/A:HgpMcEdgiDKhLHKLw/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617113987, "uuid": "cb6b2fc7-f606-4dea-9840-311f54ad1267", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617113987, "uuid": "e9126fc2-692e-4f0f-b1df-998a6db250e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617113987, "uuid": "66dfcc29-12ab-494e-a403-9c6c259869b5", "value": "415fc862868887832ebc7a619c6d8d3f99b7e73d5ba271a7673d7af6ec0f5fcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c30bb5-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114437, "uuid": "d94d4701-edd9-4965-843c-e5dcf647d20c", "comment": "Malware payload (Dridex)", "value": "9af5472c5b373aa83aec362c20858ca0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114437, "uuid": "393270a3-dffe-494f-b6d2-9f5ac3d641b0", "comment": "Malware payload (Dridex)", "value": "41736973d24bf4ec186e818e8f90f746cf6ef1916e0ba77d242c0acf3d244230", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114437, "uuid": "298ca0fb-43c2-42e0-87f2-db945b981842", "comment": "Malware payload (Dridex)", "value": "644319b342dfb6a4f61224b2f950b51b3e519f79", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114437, "uuid": "d5098815-9a65-4df0-afdc-5326883ed92f", "comment": "Malware payload (Dridex)", "value": "5cf5b69a78cb7a81529e1a8ec703f52d921c53b4abbaae51dc3640edef75b842e3ac3c58a6dbe4a67b3c1e640ddffca3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114437, "uuid": "9bb0aa12-2143-4b4d-a8b9-98f2b54324ea", "value": "2214BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114437, "uuid": "35dd25c5-6a9a-485b-bb49-06f6e911535c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114437, "uuid": "946bce72-143c-4e88-8a15-3728f637e849", "value": "3072:r3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:rJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114437, "uuid": "4990fa83-c641-4332-881e-d707c7b2879b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114437, "uuid": "f204e008-8f77-421a-8b96-ff4707942e42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114437, "uuid": "2292f19a-e14c-4443-8a16-2cee3d49ab77", "value": "41736973d24bf4ec186e818e8f90f746cf6ef1916e0ba77d242c0acf3d244230", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d8c673-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126215, "uuid": "d13d7191-bbd7-4ef5-8b95-96dd90ab5215", "comment": "Malware payload (IcedID)", "value": "70876c7f73c1a4caa55388e454fe6e02", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126215, "uuid": "7fab2a0c-446e-4965-a42d-4f473c11d8cd", "comment": "Malware payload (IcedID)", "value": "419bc2d532aceed783179940f2607c75a7ff7590ee8e13aea25878906e5fe62b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126215, "uuid": "f8bc516c-9b99-425b-90f2-2f3b59a0f313", "comment": "Malware payload (IcedID)", "value": "c8543625427d785e50622291dbd0e22a0c4edb62", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126215, "uuid": "9dcbfd06-4c32-49f1-9e50-938a333da295", "comment": "Malware payload (IcedID)", "value": "e10a106d0eed1a7023deddd2f3c8d44c9a54ce30f20c4af18d78573ce107fda01571d4632ef2b6a4d357115a4fcc6fb9", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126215, "uuid": "e7970a9b-afc2-4370-b70b-62901c5b9d68", "value": "B5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126215, "uuid": "1312ad11-6a6b-412f-943a-b607a366e7d7", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126215, "uuid": "6072267e-8c11-4885-84a8-b99624866c9b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126215, "uuid": "67c0dbcf-29f9-48be-93a7-365017bccb7d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126215, "uuid": "89ec4b82-286e-459f-8d6f-02475f50505f", "value": "document-1613795120.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e41da6-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126546, "uuid": "0ea68b3b-b8c5-4e04-86b4-19a3ee017a6d", "comment": "Malware payload (IcedID)", "value": "250f0ac16bb113079d41cc93fd013a78", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126546, "uuid": "a5305a69-d234-4c74-8455-97ff9f4b16be", "comment": "Malware payload (IcedID)", "value": "41c04d62a858786eb28046932eb26af09bfbdc86fd809b108cc5cc6bc016bcff", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126546, "uuid": "3dc2304d-99e9-4ca5-ae39-4f2b748b6ffe", "comment": "Malware payload (IcedID)", "value": "f9f17b69aead0c6d355100317ba16aff4e8d2547", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126546, "uuid": "28293656-11f8-4cac-9d19-fafd7e918211", "comment": "Malware payload (IcedID)", "value": "96cfa40e4732d9864057e797c632ff7b46408277bd64067959d68cd2fd725c511c2e606ba59dea48bf775bfd9521e929", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126546, "uuid": "d8e763d9-a0e4-4776-94ca-b203bd631946", "value": "EFB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126546, "uuid": "bd275492-6a84-4a3c-a9ac-4b93d33c902f", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126546, "uuid": "48f4a54f-ac87-4e39-bbf2-c5874e6ced08", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126546, "uuid": "06349a94-233d-48c5-a770-65b8024b84b9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126546, "uuid": "075132df-6b29-46ac-a43d-f230a2e5acff", "value": "document-315343022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65a29f3-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121280, "uuid": "211bdcdb-a76d-4bcf-b66e-6b9b5d38d85b", "comment": "Malware payload (IcedID)", "value": "100fd9e5d177ac2b192224d01deed0d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121280, "uuid": "49661689-ff80-4697-9c95-e770e132fbe1", "comment": "Malware payload (IcedID)", "value": "42600c82862581980263b61bfdeed6b2963dd4aacb4596966fbc6c97b7899fa1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121280, "uuid": "693781de-9143-46e5-a87b-68d59ec9fd83", "comment": "Malware payload (IcedID)", "value": "2cfe97f83d5130b27e29d769bca0bf921424d603", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121280, "uuid": "b5f765f2-1ce0-404e-84b4-bd44dd91708f", "comment": "Malware payload (IcedID)", "value": "3fc9fbc50ba0dd75a59d4820d3b48571a8f748d96fa84438e714da0b6e16bf889b4f4c5122533c076ea7327821832188", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121280, "uuid": "ae8c4a68-9fc6-4f77-a645-5625527f382e", "value": "AEB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121280, "uuid": "9673bdf4-bb77-46d0-84a1-81618fdcfa3d", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121280, "uuid": "b61ca796-e891-4038-a63e-205fcb8f0d4b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121280, "uuid": "d8a70aff-9705-40c8-8731-cfc19d177787", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121280, "uuid": "0e1c2a43-4455-45c4-827b-371175f32a3b", "value": "document-1097281108.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca44c9a0-915d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617111757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111757, "uuid": "a3133641-3bac-42ca-87c2-808dec023ada", "comment": "Malware payload (SnakeKeylogger)", "value": "28c83f15eb69270465249cbc63ae57f6", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111757, "uuid": "cbbe2255-2007-4ba7-8cf0-73174be88d86", "comment": "Malware payload (SnakeKeylogger)", "value": "42c8edfdae8c088a41a7d6ddfce3b6924cf1fc09d64e650ee130ee8fbbfdcb00", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111757, "uuid": "1038460d-b271-4090-80c3-c64194089089", "comment": "Malware payload (SnakeKeylogger)", "value": "93a83c1c921970125b6e56a4998db9da68595c97", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111757, "uuid": "4bd11369-0ef8-411a-bb20-3accb36b3a15", "comment": "Malware payload (SnakeKeylogger)", "value": "20ee5e46690c099687898e1516901ffb75e5b34d4ae546668503fa39827885214b89682c0088799aa5b8ad10138e426f", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111757, "uuid": "b149387d-cdff-4d08-abd3-503b4e942c74", "value": "6CE4D5A870AE805DEEB46634F5B555820FC969321F62FF3F28D66B006C63779F94E810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111757, "uuid": "cd210931-feac-4bf9-882b-0186661a29c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111757, "uuid": "ccc33ad0-3a4c-41ff-858c-e6d1064e0106", "value": "12288:8Cv5XlT1PKDrheBIWbkVvRnPZRN+p8lKkbhKk:Vbahe2/RNa6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617111757, "uuid": "bbf2528e-5857-4edc-8bc7-e502df358942", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617111757, "uuid": "518471ac-f366-44a2-a740-c738de467f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111757, "uuid": "3b68b00e-9cc3-452d-ae6b-fc4bc5123cc4", "value": "CE90343555.COM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9927dc05-9106-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617074309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074309, "uuid": "df2bc3df-1bc0-4b6e-804d-a7c619887cd9", "comment": "Malware payload (Dridex)", "value": "8056096f6f633ae37e5716f4fd7b99dd", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074309, "uuid": "f9e4ca71-0484-4c36-82e4-1d3f9a9f56a9", "comment": "Malware payload (Dridex)", "value": "432f6e16926c98e865e65e0671e5da2ac36e165e92796913687e364fb6c60849", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074309, "uuid": "997bf93a-3035-4748-90ac-e30f8b50bc08", "comment": "Malware payload (Dridex)", "value": "1a3179b7c153919cf1745efdfcdcd255132593c3", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074309, "uuid": "b8306c66-8aac-4080-889e-325eaf064168", "comment": "Malware payload (Dridex)", "value": "6c7ac3529c431009a3e676d1836125ad7f17ceb1c8f1a82a29f231d45a6e86c3120960cab24a729229f3859098cdefa0", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074309, "uuid": "6644ee19-a2c5-480e-9eb7-3ddd112aa740", "value": "85C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074309, "uuid": "f49b4407-5ff2-406a-931e-0708a7d835c3", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074309, "uuid": "c4cd1386-b31d-4e06-8e26-ba7d28466ff9", "value": "6144:DGiMOQpsduhD3AZHC/uNbExd+4Cuwf1b0717WLmw6Xg6DqaIDnnlvghV5la:aVhDQZHC/uNY0/fRm8LYQOQlYdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074309, "uuid": "04d5e6b6-7f4d-4fb0-b381-ea8effbea205", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074309, "uuid": "02cc0033-dd97-4877-a0b8-949b4845c376", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074309, "uuid": "fc96847d-0cd2-4f7d-bdf7-dc065c153901", "value": "432f6e16926c98e865e65e0671e5da2ac36e165e92796913687e364fb6c60849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6be6220-914b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617104074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104074, "uuid": "561a5176-0149-4409-b072-933bb6b57bd8", "comment": "Malware payload", "value": "c52854a63e660589be71756db911bffb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104074, "uuid": "8ca62e1b-c54b-4830-86c8-8c5d34af21d1", "comment": "Malware payload", "value": "43faca8749a7b4e579140b43631447c28cc39d7640d3fd86adbc5bcba3b004a3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104074, "uuid": "5dafec6a-99d7-432b-b8dc-51bcd07657af", "comment": "Malware payload", "value": "143a31d3cd768c7590e5c9eec61031a91e2321ad", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104074, "uuid": "669dbd71-e251-43ab-b0dd-c1c7c160c708", "comment": "Malware payload", "value": "2bbef8748542d232c567d71f3fed9762b42d6c13d94c7c61503aca8f80626e7fb4bd36666795f980943436f54c4ec4a6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104074, "uuid": "6f28c0e1-8394-43d4-9d1d-6e151f5af591", "value": "97A4235A37AF449E9303F5C223B2D5896BA1A7F0A35C0B29F5FBCD1B039B5508367911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104074, "uuid": "96ed192a-db65-45bd-af99-2323fecd6cc5", "value": "6144:800FMjlQDnIBi0rQQ5ytMYYo4qWM8rDAvfZ6GPGoGi7k71QnTE2z0ogoaoQlpV66:Qi/ZrQQItMUKEb7GRJdySLxEVGtZSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617104074, "uuid": "3a82a5c5-e0aa-4d1b-b283-6bfb99170973", "value": 462859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617104074, "uuid": "38f54633-0e5a-424a-8945-2c6dcc317ddd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104074, "uuid": "66b86fa2-87a1-41db-a6b8-ee6c636dec77", "value": "Factura_893454.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed563f2-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115684, "uuid": "262bff48-8b48-409d-860a-a06499d24eee", "comment": "Malware payload (Dridex)", "value": "fbdb36471a540bf996c50ac53ec370a0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115684, "uuid": "fa7d5baf-d085-4b77-b075-9a1cd1a88bae", "comment": "Malware payload (Dridex)", "value": "443e49c66825c2050d2781c945829bd9b6a4ad93c95e9c8ede7c05befd0c0bd2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115684, "uuid": "006f3c7c-9483-4b8a-b979-4240dd77af9b", "comment": "Malware payload (Dridex)", "value": "616f6b514faaaa711fb34c6ccfbe4466e6e21f9f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115684, "uuid": "fd52e38a-dc73-44c4-aff2-df19b8ab2fa3", "comment": "Malware payload (Dridex)", "value": "788d5ea191435250b4d66a4f0bde851df89246e7e3c890681eb673f020b8b1ccafdfb3a8f10ded65d7fd92d13f1f7651", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115684, "uuid": "4b7ee330-4e3b-4d8b-892e-6397043b4d5d", "value": "5B14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115684, "uuid": "c283822a-21e1-4e89-9bf1-ad8043e61e48", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115684, "uuid": "f2170770-5988-491e-9ecd-e5f9705e6b50", "value": "3072:g3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:kJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115684, "uuid": "663f0e04-079f-4a14-a876-e9f0ace60265", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115684, "uuid": "ca72c29d-2a35-4522-976e-d9600fd4e1dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115684, "uuid": "3f828f24-09bc-4354-9c52-45caf482a015", "value": "443e49c66825c2050d2781c945829bd9b6a4ad93c95e9c8ede7c05befd0c0bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084504a8-9179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123458, "uuid": "94b79f19-93ff-461d-9704-a535682a1145", "comment": "Malware payload (Dridex)", "value": "ff14a2d18985b8ee562542084de7688c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123458, "uuid": "544fe33b-02ca-4eea-b7bc-d27899fc904a", "comment": "Malware payload (Dridex)", "value": "44f7acde461c9a953a6377a7af09c18371be7fad4ceadafe09a41fb40d481508", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123458, "uuid": "ea2e9a21-f8a9-478b-97f9-9eb1ab2bd90a", "comment": "Malware payload (Dridex)", "value": "f6d0cf0a8ed8810b84dae771a23fde2ffb936839", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123458, "uuid": "202492a0-27fe-4b11-8187-4a869bf44b59", "comment": "Malware payload (Dridex)", "value": "a9266f5a46bc2a2c6c5a47a9ada1c929ab6d792cc4fbda40403655791d607d4b7cb3f7678a972055b94b6f87274516b6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123458, "uuid": "7dbdd102-e6d6-4182-bf00-4fc8509ca343", "value": "C014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123458, "uuid": "5067b692-58ca-47ae-b009-171b50adff8d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123458, "uuid": "204d5165-1dfa-4acd-964c-ed0d3ee2907e", "value": "3072:93PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:9Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123458, "uuid": "fa3d06bf-4033-4488-aedc-c8cef3fb8021", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123458, "uuid": "16e8f8c5-e405-4920-a420-cdbbb245823d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123458, "uuid": "981cd6dd-3edb-4075-959b-833e6ead5158", "value": "44f7acde461c9a953a6377a7af09c18371be7fad4ceadafe09a41fb40d481508", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c5e051-917e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125737, "uuid": "ca6ece77-2739-4fe5-a1ef-50afa0b68f31", "comment": "Malware payload (IcedID)", "value": "55a9db8950047f946e66e94635375e51", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125737, "uuid": "c1368d28-3b0d-47b2-871d-c5573fc298da", "comment": "Malware payload (IcedID)", "value": "4531a5ed6fb4a6ff8bb556305f2a85dd8e3b6f5100c1188223725d50a75ba61d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125737, "uuid": "7efe242b-9b9e-46aa-9c3f-07d8cad9bad7", "comment": "Malware payload (IcedID)", "value": "60e88562fd006a56800f935e1550ed4422e02b5f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125737, "uuid": "26a9a8f5-1168-4b1f-a2ec-c46062e71a29", "comment": "Malware payload (IcedID)", "value": "4529557dbfaf865e7f64748f6c0b0cbb3f3dfc34b7ac1b9b6bf90d2984a46fd43629904d3c276ff90180d90df7ff2826", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125737, "uuid": "daebb48e-f464-4959-b5c1-a35827595132", "value": "25B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125737, "uuid": "5e2aee56-71d3-4042-a4f1-2a57b66d75ff", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125737, "uuid": "d4f61899-363d-40f8-a3e5-7bdba167f4ef", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125737, "uuid": "89c89a9d-3a64-46d3-a8b5-4032e32735a4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125737, "uuid": "f5045e34-b93e-4d14-b232-978d4a35b47b", "value": "document-1657482.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfa5b98-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120219, "uuid": "9494c734-ecd7-4991-a77d-5450cb4178cb", "comment": "Malware payload (Dridex)", "value": "62173ebc8d17983ac478fb9861587dea", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120219, "uuid": "ed6546c1-ae97-4c89-9911-362e48535c5a", "comment": "Malware payload (Dridex)", "value": "45455e182aaa17124d35d906531be9a1223daf74a66c843e071ba0420901a8f8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120219, "uuid": "ea2a90ec-ed3a-4ff6-b0b3-e3936b9476db", "comment": "Malware payload (Dridex)", "value": "86b9a3bcf62b374bf923270acb958b37fcff2f57", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120219, "uuid": "870f5605-d210-4b64-87f1-52efa0298122", "comment": "Malware payload (Dridex)", "value": "91e3c7a8632cfa172626181d3b58346c75881f975d247f81a53ede7542f99bf61fe17bc4df98a07101b764ca40817733", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120219, "uuid": "9daea1c0-f43e-48a3-83d4-48d970dacde1", "value": "B514BE2DE333D495FFF7CAF41492AA2A8A7B2D40821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120219, "uuid": "acef9200-84bb-4387-971a-9bdd4ca91df8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120219, "uuid": "e045985a-d96a-48a1-96fa-c45627ced366", "value": "3072:Q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:0Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120219, "uuid": "b9205632-6126-4104-82b6-c3eaeb5a73f0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120219, "uuid": "618d68a0-509c-4795-bf9f-d749668007dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120219, "uuid": "719f9f86-4e73-4410-9839-9ff69514e7cf", "value": "45455e182aaa17124d35d906531be9a1223daf74a66c843e071ba0420901a8f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac005a63-914b-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617103975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103975, "uuid": "56615e44-c34a-47c9-925b-29e271cb887d", "comment": "Malware payload (SnakeKeylogger)", "value": "b38b873c6296f7a4616e17fa12b37de6", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103975, "uuid": "fe8bc0e8-43c8-456b-917b-4ae7e9941da1", "comment": "Malware payload (SnakeKeylogger)", "value": "4550165b314eea5d106bdda8aca38991b18bfc03b2deb54137ce32de2f445611", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103975, "uuid": "ebd45bb8-56d9-49eb-bfdb-9e59b0bcd057", "comment": "Malware payload (SnakeKeylogger)", "value": "3b04c985f6cf0b86c7379c66bc591ea744d20480", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617103975, "uuid": "0ba0552a-5d94-48fd-9c84-2b281c86e47f", "comment": "Malware payload (SnakeKeylogger)", "value": "321d3f452355bea0948cda025f0b38ce6506890c734fa968959a6f6823c5b90a5bd2acb34f189300bee19853298b113e", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103975, "uuid": "fe414014-8971-4e24-add5-250474b2c043", "value": "B305C2A870AE405CEEB46634F5B595821FC96D321F62FF3F28AA76001C73769F94E910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103975, "uuid": "7d31b06f-176c-487e-9028-dea6ad4e483b", "value": "12288:7sM1tcQWkSyy9TJ4xIA7e2s0p1ouZ5KAjd18Sa:nKQInTJsX1s0IBAjd1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617103975, "uuid": "8913c054-88f2-4f29-9e87-067706f44e27", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617103975, "uuid": "a5c4fe5d-ee57-4b01-982e-ad7679ecac16", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617103975, "uuid": "30890edb-dc2b-4f6f-8e68-07458540992d", "value": "BESTELLING BEVESTIGEN OC639BH7,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baaa018-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131731, "uuid": "ed9662de-1965-4e5e-b239-cb162b772d2e", "comment": "Malware payload", "value": "e4f8f8347cdb41db3f5cb0713aeb0823", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131731, "uuid": "c72a1073-c2ed-412d-aa7a-0c2f5d34098e", "comment": "Malware payload", "value": "4573ff0c60f9484ca2e533b254bc78b912966338a0a5dd7d6c9168f410cee4bc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131731, "uuid": "38d4a177-a6ab-475d-89e2-efe3dd43192c", "comment": "Malware payload", "value": "6920426dbdb6583ec6952740f6aae2869639c771", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131731, "uuid": "b2381e36-a231-42bb-ad9e-576398fb21c2", "comment": "Malware payload", "value": "736b88c016e93dce61545ac33d21b8cfc38522a793beba53017035e6b9ff83f5c8abeb82192c7bf5d5541099cda8f975", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131731, "uuid": "7dced303-9ee1-40dc-885c-d1170c170794", "value": "6514BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131731, "uuid": "7e47c452-6bd2-496a-893d-00e8138960e3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131731, "uuid": "c420e4e3-214b-4e5a-8970-8c08b87a0b1a", "value": "3072:03PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:wJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131731, "uuid": "6bdee4c0-d583-42be-bcae-00cf5d4bdc50", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131731, "uuid": "56407283-48ea-4799-b32e-edb901dcead8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131731, "uuid": "72e410f6-6628-44ab-baee-b8a1c9637bae", "value": "4573ff0c60f9484ca2e533b254bc78b912966338a0a5dd7d6c9168f410cee4bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b366d49-90f0-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617064836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617064836, "uuid": "dfe1018a-baf6-471c-9ca7-a4fa771899d4", "comment": "Malware payload (RedLineStealer)", "value": "f6af44fa5af70aa2d4f4b7fc9006d30d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617064836, "uuid": "83003707-fe61-4308-a48d-0c6d9a369ea2", "comment": "Malware payload (RedLineStealer)", "value": "457ef54ef04120925f12519bade2263927c7abf60fefbfb8d86e78a2e7d9adb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617064836, "uuid": "7e1780a3-8489-4f11-8caf-56dc07063a7c", "comment": "Malware payload (RedLineStealer)", "value": "562f3bfb126ceae578d01dbfbdca7887bf0f2114", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617064836, "uuid": "a9c2ca4f-8e5c-4895-ad55-f37efb5729c1", "comment": "Malware payload (RedLineStealer)", "value": "51853aef7dca234b34e67d386eb8b655b7209351b2856b285285ec2b1f928746fa54de9023b8dc9ef39920c0378683dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617064836, "uuid": "a764004e-db07-47a7-a0c8-5045f16688d9", "value": "34443A10275CEA59EB7F0B74E4B4301582F0925BF522DBAE0FC1A4C95F1AF8276116B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617064836, "uuid": "a4e282db-b222-474e-a756-7485b0c75120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617064836, "uuid": "262d7198-8427-4058-9b0e-024d90db3a34", "value": "3072:/UOWb2gPc3ZVfaF9pLQOooooooooo8nQW54FMd1Dvl:/4bciFvQqQPF+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617064836, "uuid": "60b4dcd5-1d7a-464a-a854-193388ccba0a", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617064836, "uuid": "a96328c0-d2c6-49bc-baec-6a907e4cc1cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617064836, "uuid": "389fd91a-fdfb-4bf6-8091-f293344bbd11", "value": "F6AF44FA5AF70AA2D4F4B7FC9006D30D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40a2a47a-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "50870921-8b08-4b4b-9679-af18073116e4", "comment": "Malware payload (Dridex)", "value": "10f8472afb0501ed34d0df7909f9b851", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "2804f7bf-e4b5-4962-8580-92a83e7d374d", "comment": "Malware payload (Dridex)", "value": "45877c41c5c24f4dbb016d6f7b51945dfa021c64d88ab7a82c84c6d5bdf98f8a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "31b1026c-7bb6-4fb9-9b5a-bba104188bca", "comment": "Malware payload (Dridex)", "value": "4e6534a8b7ba5eb3f6a5e51b5a35cf27c3295ae0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114103, "uuid": "a94e9b18-d35f-4c39-a6da-3316c12db4f1", "comment": "Malware payload (Dridex)", "value": "1143e6522644ef3cd37390c9bce91090830e4a93e1afe8107eb5636ad98b9a678db438cd3964ee71d472b941f1227773", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "0913abb2-6839-4fc7-a841-2dbc12c454ec", "value": "6114BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "688942f4-4b4e-4653-998a-deadae22c756", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "c0c6c9b4-9ab1-4900-83a6-1b77326e9922", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114103, "uuid": "18a394b2-ef56-4f26-a102-71b91d729e63", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114103, "uuid": "f68ee4ed-d0b9-44d6-b412-cdc2444c0829", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114103, "uuid": "025725ed-c692-4d5e-8bd7-b662de16b789", "value": "45877c41c5c24f4dbb016d6f7b51945dfa021c64d88ab7a82c84c6d5bdf98f8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a78cff1-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "2404b2fd-95a5-4656-93fa-5572513ff256", "comment": "Malware payload (Dridex)", "value": "d476d6460bdc28f6577cdf8e1ec4ba0e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "09b7cff4-0e5e-477e-b177-eca3782e6230", "comment": "Malware payload (Dridex)", "value": "459c8a4c0fd7b7d238c796758f8794e495dfcec802d225ae1b0332fd00bca95f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "da4bd834-f077-4f6b-a42b-b2e8443db060", "comment": "Malware payload (Dridex)", "value": "7806b407855639cca0c87e72369751c48465bf14", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "c2f191fb-ab80-413e-8a2e-e3a334419571", "comment": "Malware payload (Dridex)", "value": "ae397ae4eb71c3d8b2f6d3ddb23fedf65db235846070e5656f7221e9c06a704e44bed1a16b7a2ab36795477bfb6820e4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "4faa71db-c96b-4cd5-b075-2464cc05ad15", "value": "7914BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "a46e5bb2-2d38-4aa7-87f0-865ef02df346", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "c3fb8ebb-8074-44c8-b604-9e0baecc26bc", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114093, "uuid": "c9dc2440-cc37-4e06-bd69-913a5174ac4c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114093, "uuid": "cee82671-2ced-4711-92a5-b7177cf6a36a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "b503bfed-05c1-4303-ae3a-7eeccb9155d5", "value": "459c8a4c0fd7b7d238c796758f8794e495dfcec802d225ae1b0332fd00bca95f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c756fe6b-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108746, "uuid": "5ebcba53-004e-421b-935e-d1fa40b0031e", "comment": "Malware payload", "value": "cc49e1238791f16c6b1c3c9be4a0f7b1", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108746, "uuid": "2e8afe14-a6fe-47ee-86c2-3c219a3c1fda", "comment": "Malware payload", "value": "45d63493404a506ef0bb8a40b6716e4b12fd631d1e5968d7bcd95be06a3a574c", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108746, "uuid": "5ef1ba1f-f40e-4813-9c6d-491d99345ff1", "comment": "Malware payload", "value": "e1bfafe1a457c2435653d14b7fb4db3257950e0d", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108746, "uuid": "96969a04-208d-4ace-a3fe-5587f5551ab6", "comment": "Malware payload", "value": "4dae1d1f88e98d75d1b137a46292583628a77629836c7175e72071d44061704a3878267324f17483e2b42feec0b0f8b6", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108746, "uuid": "8eee73e7-2fd6-49f1-a6b9-ed5e143d4a6f", "value": "A39312835B78EB6E8D276B7A07CB256249E635385C3E3A5D1E0C07F0209B1A50F7DA53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108746, "uuid": "33287ee6-2949-416f-9527-36216f54d98d", "value": "1536:og8Mf6nCcLWX504szLXlRdtnvu+043lRoki7jr1oh9V+lkcv3N:og8tnNLkozLXNtvuwXJy5YuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108746, "uuid": "eeb87137-0781-44bd-a59f-a20d2f9229c0", "value": 93251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108746, "uuid": "0fa7f37c-3913-40b2-a000-572d09b51a62", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108746, "uuid": "fd4a6780-7ad5-4364-ac4e-65dd94a54364", "value": "lista_108.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "262296d9-9137-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617095161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617095161, "uuid": "05f5f515-6e14-4882-8581-c0c85037dd31", "comment": "Malware payload", "value": "5ab29899dff428ce869a534bce9606c4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617095161, "uuid": "718db9d7-8660-487d-ac8b-91c14d1f57d5", "comment": "Malware payload", "value": "45e4c13fc2129ad32023550f1bb08b7266ec353b19be399aa7ef7ba4bb543049", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617095161, "uuid": "76bb1d02-4b39-45c4-93ea-f31cc0b85606", "comment": "Malware payload", "value": "9274787c4916caa67e40eb0167c40c53761c2726", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617095161, "uuid": "6462a052-c349-44e4-bc6a-df06b430599f", "comment": "Malware payload", "value": "e8e6b3fb0f3b1881b62d21dc30fe677f2e75e5113539e4bd105ce65bfb423787264f3650596811bab4b49cb5a09ffdeb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617095161, "uuid": "6c8ec0ef-d20c-41bb-a895-936d5d731418", "value": "0814AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617095161, "uuid": "9e07ddec-b756-4fbe-a09b-d00406731d6e", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617095161, "uuid": "4f9be007-400d-4887-994f-76074c0e16db", "value": "3072:71i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:5i78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617095161, "uuid": "f1fdae13-8d42-4c1b-8b56-a29544af4426", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617095161, "uuid": "5a8c6723-3b02-4028-8dd0-0c97a41320de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617095161, "uuid": "aad86630-b9af-44b5-8304-80f598740ddc", "value": "45e4c13fc2129ad32023550f1bb08b7266ec353b19be399aa7ef7ba4bb543049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee62af1f-913e-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617098503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098503, "uuid": "b144cab5-953f-4e11-b715-47312e522c89", "comment": "Malware payload (AgentTesla)", "value": "5d96452c3067bb9896f88c52bb6b6ed1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098503, "uuid": "ec93ab40-4669-41aa-9622-ca1b0bc1b43f", "comment": "Malware payload (AgentTesla)", "value": "462612f8beb46fdd79ebe45b7fd528f07a800aa62c19749a73075dfa334d8090", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098503, "uuid": "137017c2-55a4-495c-a81b-3a7343372a7a", "comment": "Malware payload (AgentTesla)", "value": "38ee4d2fa51142c1055f0870705bd99c1cec45b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617098503, "uuid": "268fec35-629a-4273-8dd7-2577caab8166", "comment": "Malware payload (AgentTesla)", "value": "66af390c468bdbbed8776a7b8db568ea405f0ea69cf6fc4e3bc45a910989e5055e51aeca16a802679852c8e809e89536", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098503, "uuid": "3a25928e-0e22-42ac-b86f-eac4e6aa29c7", "value": "2D84AFF876147DE6266F53ABDE966CDD03B62A638ACB94CC806477C305A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098503, "uuid": "976c9b45-4bd7-4f67-8975-9b087eb60077", "value": "6144:qYfAbGua3CUdRdks1rzojSzPMw8y9o5MXhV1nBe5s/a9j9mAIMG+0eQ0jajDV:q/havvsjSzPMw8y2shVNEcanbG+0lVj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617098503, "uuid": "2ccbfad0-4f59-4344-a86a-22059f5f75ec", "value": 388606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617098503, "uuid": "257ece40-1ff7-4275-b50e-09bbaeda3bbc", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617098503, "uuid": "9d197191-9d3a-4ad8-863c-331f7114de8c", "value": "DOC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96757b84-917a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617124126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124126, "uuid": "cba11872-bb65-4210-ae16-fc24a5b7291c", "comment": "Malware payload (IcedID)", "value": "387f6827261abf352402d09f144c7e2b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124126, "uuid": "2088537c-738d-46bd-b13b-fa17e2415184", "comment": "Malware payload (IcedID)", "value": "46360f55ed619f5e91d5237d4ff05f809b4cf0294da015e7dde3c400698c045f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124126, "uuid": "692a3e40-f7bf-46b4-9a05-24a3ea30dd13", "comment": "Malware payload (IcedID)", "value": "3eddf2f4511b70e96ab3589b126edca18a323d69", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124126, "uuid": "ea225e49-e426-4d4e-aebc-79926c5f25d0", "comment": "Malware payload (IcedID)", "value": "93f662226d6cef839d08eddb8c79798cdb33cf3e71c1ef7aa865defb75f1cbe7518dc1b344b9964dcdbc6232c8a59418", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124126, "uuid": "61c61ef0-f12b-4983-86f9-af5dd3b27842", "value": "2AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124126, "uuid": "50fef942-b93e-4c54-a08a-9d7e46832eb5", "value": "3072:42CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:4zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124126, "uuid": "63aa8e02-fd93-42a0-8912-8d9f3fa7d9a1", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124126, "uuid": "9c4bb0a7-e9a8-4b05-8198-936cdf41863f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124126, "uuid": "949a85ee-9876-4a27-8421-3c84c9f5dba7", "value": "document-280792049.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7b0832-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617105557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105557, "uuid": "86dfc791-c06c-4ac2-962c-8a1e19cab822", "comment": "Malware payload (Loki)", "value": "54e50584ccaa05afaf20d1a5b20539a4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105557, "uuid": "7cd9ecf2-51e2-4478-b94b-8a3e310b2a60", "comment": "Malware payload (Loki)", "value": "469c9a5e2d3688f82ac2ba45589b37e34a6f75464e8292c2898a6f47b9fdf7fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105557, "uuid": "cee48845-d4c7-4207-b06e-3115efc5537b", "comment": "Malware payload (Loki)", "value": "dc6eb04059912b3fe984a78bafa9059e0d50642e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105557, "uuid": "19162f63-0f3c-4b44-8d66-9dcbcca1c303", "comment": "Malware payload (Loki)", "value": "c8d5d8c835b7ae21bfc43e912b9f6ed4fc44d166c062b98701d37f8338e57434f1b74690212777696aea7db7e4553385", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105557, "uuid": "afecd9dd-a1ee-4e64-ac51-e6c05b7fc2fe", "value": "2075E0D127667AC6D1634F029A56F84CEF17F02BEBD25068F10EC33E479F1ADA291852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105557, "uuid": "ad013db0-7493-4256-a008-c4b46cb0a69a", "value": "49152:uSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlSlS+:uEEEEEEEEEEEEEEEEEEEEEEEEf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105557, "uuid": "bea5de7f-267d-43cc-b3cc-affdd5dffb37", "value": 1609896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105557, "uuid": "a3c4a90a-570f-424c-8034-d5e243d04ee7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105557, "uuid": "3d26a0e2-523d-4e35-9ba0-605fbf185c32", "value": "IMG_071_34_02.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8300733d-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085438, "uuid": "039b7904-fedd-4172-a804-67f20b8552f7", "comment": "Malware payload (AgentTesla)", "value": "8dc337fe3ed9256df0a5b6ee31be7436", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085438, "uuid": "3be8e958-4df5-41de-b172-20b1bb03dd60", "comment": "Malware payload (AgentTesla)", "value": "46d5a51da189bda1bfc4506c210db21cf2baf3d06ff2a8f566a46dcd12f13484", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085438, "uuid": "5dbf3999-48ac-459d-a5ef-0a67963970ee", "comment": "Malware payload (AgentTesla)", "value": "7d928a0c3e4cc49cfce93308cc0687ea1147fdd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085438, "uuid": "6d405587-79d8-4f07-95ab-ae2236dd02cc", "comment": "Malware payload (AgentTesla)", "value": "7629a017beaad36d703baf2cf094f7296e33a46696e2aa19a771b6f2d018c324cb45288ae9f1f5974e3f8bb18f963673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085438, "uuid": "7e6130e7-51ec-48d7-b195-cd7da3205ab0", "value": "72B4CF3573A86BBAC15D4F3B48136D0483F582137132F69A6DFAEDC21864B854E3FA19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085438, "uuid": "7ddd6c07-ea23-4aad-ac64-4613d39a445d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085438, "uuid": "60a5a8fd-7bc9-421c-81d6-1b6fe70b044c", "value": "6144:ZLPmn2ZFc4CDpiO+QYDC4PR4w3/nAiIj9xPNt1MZ/bAidxlAKPmext7hE5:dPNFc4CtiO5yvAioJexddHAqmenN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085438, "uuid": "6e337bce-2f47-4870-a56d-56c2d6bbd87b", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085438, "uuid": "20dcdfa9-040e-463f-9831-f667be2b6d2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085438, "uuid": "01ddd718-7083-48b5-83d0-6b7cada87e21", "value": "Shipping Documents.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23b4e6c-9125-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617087746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087746, "uuid": "a86995fe-cff0-444c-98c8-b2fd1e3b3ba8", "comment": "Malware payload (Gozi)", "value": "ee9dc90235dfc1cc0b4ab0775daaaff4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087746, "uuid": "af41d31f-8ece-4eb9-8d3a-52a8618e8c0f", "comment": "Malware payload (Gozi)", "value": "46eeef418745fe61c1c5bdf6f828339a5cabc45215fe961a9ce235360dc65f3a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087746, "uuid": "90534e8f-a5ae-4a9f-90a0-98fc6d0f7df7", "comment": "Malware payload (Gozi)", "value": "16d61d8d7ffaaeae98e16163bdda583dd225f903", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087746, "uuid": "ea9e8a67-64b0-44fc-9788-85113f848e12", "comment": "Malware payload (Gozi)", "value": "37732e1ce11f308263b8f20083184f3b571a9b5d59cfcf0341f31aec68cd370f9871a6a1ef13de61ffe0daae0ac8ac0e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087746, "uuid": "158b3c2b-800b-403f-b796-481d6d3339e7", "value": "3F74AE053BB0C5D9D2A521B44ECD8EA4E924FCAA1F20D21372D975DCBDF9F89262D381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087746, "uuid": "b6a69d36-e049-4f6a-b022-4168f217e51c", "value": "77af713b1f2916ea138f9bb7258cf849", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087746, "uuid": "7e8e41bc-95d3-4ceb-8b8b-a6cd7ca6e327", "value": "1536:bepG5ACCny8GenidAHcz92ZIx9FxIl+YkSVoZlP1usBVEwnoxJashnXcX:36lGeExx9FmSSkfBt8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087746, "uuid": "1c7355ed-bdbb-4836-b7d0-ee6cdb5556bd", "value": 367878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087746, "uuid": "223adabe-f3ca-4bbf-a7bd-e43e6da02e1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087746, "uuid": "6a93699c-60a7-4afd-a4bf-60a89533f531", "value": "ee9dc90235dfc1cc0b4ab0775daaaff4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a03d609-9188-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129957, "uuid": "22a287c9-f3eb-4223-93e3-6959f58c7b92", "comment": "Malware payload", "value": "dd5862085834e3c9531436a1f15204a6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129957, "uuid": "62f2acf9-e0a3-4a5e-8dcb-48557185ae4a", "comment": "Malware payload", "value": "475157a2d9a523c6412087f77ea099fc270f4d4157ca3647a14fbb21e802341d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129957, "uuid": "402cffc3-f443-4287-b9b7-e6a8081ff607", "comment": "Malware payload", "value": "21df6e4c5af1f7b9a9000e5751fbc34437118509", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129957, "uuid": "4e22d0a8-59b7-4b3c-84f0-ff629972e7b9", "comment": "Malware payload", "value": "e38d0e984ca4ab75d0618cb0d904577f648edf955f929e947387c667ac24ebf12c2e43d95a36df17d48fb303b48a3e6c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129957, "uuid": "dd17631b-7c2b-4616-831b-c85d61bd8e13", "value": "0A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129957, "uuid": "56262ae5-1214-4973-b20c-62a185021a09", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129957, "uuid": "b0d3aa3a-8e5d-4152-a264-bac7cce9212a", "value": "3072:R3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:JJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129957, "uuid": "39c26267-ebc8-46ea-8e95-d8ecef897aef", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129957, "uuid": "40515984-a4d0-45a3-9975-fd7b80e41397", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129957, "uuid": "deca39dc-99d5-407e-9714-bf630d18a0c0", "value": "475157a2d9a523c6412087f77ea099fc270f4d4157ca3647a14fbb21e802341d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8ef37c-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137133, "uuid": "2f24c4a7-2ca9-4501-bf61-edbbb6465dda", "comment": "Malware payload", "value": "87cb9d9f58ffe1a4d32ec39c22b533b8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137133, "uuid": "94fba071-7084-43b1-9627-509706a188e3", "comment": "Malware payload", "value": "47955d8b154e85ce1eb75da484d8244fab7695911360388b40ce95ab2ec13a31", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137133, "uuid": "1a9984ba-0814-4ac2-8138-b7603c3f903b", "comment": "Malware payload", "value": "41d983da521d350934f991192e542b56800b72d4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137133, "uuid": "fdfecdd6-ec3c-4746-a3d3-c667a7aa5c70", "comment": "Malware payload", "value": "727ba99e442bdb437511dfba938a2a8c08fcec173b076694ac8c00c64a073f2a9156ebfd83379dd62e7295e09780ec4f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137133, "uuid": "6a9d42e2-ce7e-4151-a15a-7ce400744335", "value": "6814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137133, "uuid": "49f2b161-d874-41ae-bed0-8cf2c4363c22", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137133, "uuid": "0eb1de75-6ef3-4e46-9c2a-6b7cacf9b8b0", "value": "3072:o3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:MJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137133, "uuid": "a90e2677-3244-4bf9-aa82-2355191a8bac", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137133, "uuid": "599bcfc5-3b8a-42be-bb8f-59f69b5f4335", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137133, "uuid": "616baad5-e2ab-41a5-a88f-88c5568c9f65", "value": "47955d8b154e85ce1eb75da484d8244fab7695911360388b40ce95ab2ec13a31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638789d0-9189-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617130483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130483, "uuid": "c73b49c5-bc7e-46fe-b3b4-19d8fd1cad1f", "comment": "Malware payload", "value": "3c61291ba2d0f5c7ceef2ce7f0b0fbf0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130483, "uuid": "4dd02c6a-e502-4e61-87aa-fd3d60b3fb1f", "comment": "Malware payload", "value": "47a2533568a7250e2cb18a5e553702b1288c671d935b03ff79ac50d67f3ed224", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130483, "uuid": "c77270b3-e07d-4cdd-9717-1c4a69cd29bf", "comment": "Malware payload", "value": "d9ececff36e83320e641e786f28c608373c421aa", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617130483, "uuid": "b1a530d3-7b05-417f-a4fa-32c6cedee4ad", "comment": "Malware payload", "value": "310387dd2adab8f10497c689b3740548210af0199439cc2a4a7e786c05fba4e8915f7be80ffe591e5067fe0e3818be98", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130483, "uuid": "ea653dea-079b-446d-9a50-1a4db69d382f", "value": "BA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130483, "uuid": "2c4466dd-5665-4fdb-8232-6c52608ca55c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130483, "uuid": "cbef0aa0-c729-4458-9122-719f3913257e", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617130483, "uuid": "4cf19ee8-e8f5-4ffd-9827-a8f8bf9993b9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617130483, "uuid": "87e69455-b925-4c71-9010-ff39e3f2c180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617130483, "uuid": "39966e37-abf8-4e2a-82d3-960e1908f2d5", "value": "47a2533568a7250e2cb18a5e553702b1288c671d935b03ff79ac50d67f3ed224", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ca616b-91a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144316, "uuid": "afdaf1fb-085f-4a5a-8e46-ba80ac870fa8", "comment": "Malware payload", "value": "9ebdf01dfa1a7b7249ef5056ddb4a522", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144316, "uuid": "36e162a7-aafc-41d9-b6b2-707554a4a203", "comment": "Malware payload", "value": "47b4879ca05eb86f09aeb241b7965b7391c69897f5d32013eb1dfb5f44b7f5fd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144316, "uuid": "ff1c8b33-5beb-46b0-8a4a-5e24d46241c2", "comment": "Malware payload", "value": "4dacbb94ea485e0474e9362f43c2761fa79713c5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144316, "uuid": "49d15d81-3c7e-458d-8e82-4d146b587d86", "comment": "Malware payload", "value": "c9458cf3a2cb63370c4b45c5b7e28c364b4bd72b4de6a1f02e08639c147cb70057c9cd83af6e6aebff23201c40e4cadd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144316, "uuid": "190fe7e4-e735-44c8-a88a-36270c1d1e31", "value": "8D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144316, "uuid": "78f8329d-ba17-4bb1-b690-11e947fd17f5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144316, "uuid": "4de41360-b40d-4f0d-aa80-b50d0f7283b2", "value": "3072:03PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:wJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144316, "uuid": "8d657235-b94e-42c7-ac2f-2bc9eea2c3fa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144316, "uuid": "d3f2fa36-4ad4-4ea2-84d8-bddd9ae9a1be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144316, "uuid": "f605002b-2ec5-4cd6-89a8-bf6e902d6c80", "value": "47b4879ca05eb86f09aeb241b7965b7391c69897f5d32013eb1dfb5f44b7f5fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f818fca-919e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617139522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139522, "uuid": "288d6159-5c9f-449b-b6f5-b87e49d96c90", "comment": "Malware payload", "value": "ec5bfe54fbf8042bdb31e8ee5b68a735", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139522, "uuid": "83d351b8-0e27-48c0-993f-b859a9d8e86c", "comment": "Malware payload", "value": "47fa23cbc79c5b1ae59c37417b14f9308f3538e273364b817054d9010553cb0d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139522, "uuid": "35589d01-2726-401a-88ec-cad410aada50", "comment": "Malware payload", "value": "b0922b4a37026c2b912ada7f92836f85e0398db8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139522, "uuid": "0dd0100d-2555-4828-80f6-b42130e67569", "comment": "Malware payload", "value": "70851dd6f4b49b1ddea18ee7b979ca4a236119891072f88bb51b6247735d8f033a3797b26e9b1d703a07ecd38b119363", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139522, "uuid": "beb2f31b-423d-47f3-a28f-708b58bcd469", "value": "2314BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139522, "uuid": "95601164-eef5-4ed9-9643-8b0c0854d71d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139522, "uuid": "203d1215-18bd-4a19-af87-944cbe1d7742", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617139522, "uuid": "9296496f-8e18-4dc7-817d-6b3749845690", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617139522, "uuid": "66a0866a-f651-4c17-9538-9b500eb422e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139522, "uuid": "b011de9f-7dea-4674-b8e4-09d4fcee250b", "value": "47fa23cbc79c5b1ae59c37417b14f9308f3538e273364b817054d9010553cb0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2c8c50-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121805, "uuid": "8b24c89c-9027-4f55-be63-65b3637bce5d", "comment": "Malware payload (Dridex)", "value": "fbad1775540daefd38894227cf682cb4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121805, "uuid": "eda19b56-72ad-4fbb-80f8-27e08b6677a6", "comment": "Malware payload (Dridex)", "value": "48024162a0cbea67b34af553fc9c5b35dcd1da4d9e4e593a4867082aa499497c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121805, "uuid": "42ff4635-bec9-4c3c-b78f-30769b58424d", "comment": "Malware payload (Dridex)", "value": "c329ab73dcb86edfe8a258ea379b17faa21eeb2a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121805, "uuid": "a2269a4c-0a42-4e9c-a0cb-93791c4dceea", "comment": "Malware payload (Dridex)", "value": "d89e0d96f53228781aa20a13c7c091c0dc8f4c0080af93c38ed01260a37db8ba87123997e0f6cf16f91bcc39ac4050a0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121805, "uuid": "9d91f90c-ffd3-4114-87ae-617ca8e6f939", "value": "4114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121805, "uuid": "22760df6-607a-41c8-9ad4-da8994f79e8b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121805, "uuid": "9ac9fc61-7830-47c7-a61c-7f9c754171fa", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121805, "uuid": "68a57265-3f0b-44fe-b842-362054b3b67a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121805, "uuid": "b65453dc-1093-4942-883b-c9cf20eef9a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121805, "uuid": "e2583c75-d46d-4188-ac4e-34f0f09477b8", "value": "48024162a0cbea67b34af553fc9c5b35dcd1da4d9e4e593a4867082aa499497c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7eadbb8-916d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118571, "uuid": "a4e7762b-6bc7-4298-8a4b-ccd0e3072de6", "comment": "Malware payload (IcedID)", "value": "8dbddd15a1f9b6c0709d202c553a9243", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118571, "uuid": "c048d460-cb93-479d-a564-501b1670f133", "comment": "Malware payload (IcedID)", "value": "482dc14e027fba53771b1b1604aace4ad9059293c8a91e154f813e453e739939", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118571, "uuid": "a3be10c7-fabe-4c9c-b5b0-f3e07e127649", "comment": "Malware payload (IcedID)", "value": "2f1e952da5f7a5239c8ef7ce35733ab665961aa3", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118571, "uuid": "e4398634-0c8a-4de4-9ba3-ea3e0ad4f381", "comment": "Malware payload (IcedID)", "value": "0f0c397cbd8a3b78b430f37b2ae5706a6834c300ebae4cab08a81bde04d8eef571269bdebe4e1516bf316a0ed85f2769", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118571, "uuid": "816cdbb7-1443-4c89-a70e-3dfbbe749ffd", "value": "88B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118571, "uuid": "efd0a874-2697-48c1-94f2-415cf800399a", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118571, "uuid": "cd2cf43d-33a4-467e-ba8b-cde5fab95254", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118571, "uuid": "1c69967a-7516-4927-8151-e03b0072d289", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118571, "uuid": "e2ecdf4d-e436-421a-a6d3-bb60d44e5e75", "value": "document-1909866364.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33d82f0-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106591, "uuid": "6c7d9b1c-10ec-4e69-a508-f76711938d8a", "comment": "Malware payload (Formbook)", "value": "1d95f8a84bb4f8c7073dde22bf197d4b", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106591, "uuid": "2a65b4cb-991a-441c-bc35-79435e1f016b", "comment": "Malware payload (Formbook)", "value": "482dc688a9eb8a5f5e29f4dd86eaa587a5ddc7dfd5133376ac2fb7e28dc9082e", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106591, "uuid": "19a2fe33-b7d6-44fe-80d1-7a7b58fb0ca1", "comment": "Malware payload (Formbook)", "value": "cac4b4a504a94832c477496a7957637cc25b131f", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106591, "uuid": "b74558b5-37b6-4794-966a-b7038885f294", "comment": "Malware payload (Formbook)", "value": "8286c3864e3b3ee8abab761086bbef5bdd25d07c5704572c5fe6c296d8f3cbfe8a521bac5136bc824b83ee2c26668243", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106591, "uuid": "b0baaf4f-97a3-4397-9747-2dcfde7a5c63", "value": "EA84237EE2144A0EF769FDC51204127A4E080B4CD655A301A3D1AAB3D9E2C4DBFFADB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106591, "uuid": "264515d5-ab21-4051-ae5a-e69fd676e64c", "value": "12288:MgsCEK5bFXOW1KagHGeOxQWfzGth3ZA+R/uWlO:MTNUp1YJ8fitT5/uWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106591, "uuid": "f2ae0fd3-8f20-464a-b410-af3818978fe4", "value": 401926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106591, "uuid": "d241cb56-7652-48ae-8265-56134dd9b14d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106591, "uuid": "54195ad3-3fba-44f7-ad35-3fda5f9b7200", "value": "P33021.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc7bc75-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617106770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106770, "uuid": "3319c94b-b682-4c1d-9863-d9b3b9ba4821", "comment": "Malware payload (SnakeKeylogger)", "value": "0d2ef50fbd51a116e6844534a8baa4f7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106770, "uuid": "ad9e55f6-c899-4ee9-8dbf-9fe1d9f9e249", "comment": "Malware payload (SnakeKeylogger)", "value": "483294141d138bf0a296a7b08e649c294bfe205422a74fd374dc1c77d463f9be", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106770, "uuid": "db8eb11f-74bd-4e0e-9bc3-7827fb334466", "comment": "Malware payload (SnakeKeylogger)", "value": "811cbd0009faf022b3834d827d559c4a24547f8c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106770, "uuid": "4068826b-52b7-4b60-9246-8337afa820b1", "comment": "Malware payload (SnakeKeylogger)", "value": "6d1ad5fbcd3e5c513b34978cd96f83b43f5d0417a412d656042418480ad31741a10142ae81094aca560cebbf0ad0079f", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106770, "uuid": "af88c637-5ef4-44f2-bd3d-b5ff1b31b573", "value": "90D423118A2D27F63D1CFA745817F1E9DEF19B509E8EEE39D859C89F870005C1AEC12A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106770, "uuid": "82dc6e6d-d5ff-45b0-ac0d-c6f31ca11638", "value": "12288:V8qPz456pMFErOeSlBFQhB5hyGIlVGXWQiNJNnwV9njsaFYE6Qj7QS4FkXfapQS:K0A6+FE6FQhclVG2pngjkQPQSYkPapP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106770, "uuid": "d7315eb2-d249-406e-806f-b6a51aa97ac0", "value": 611766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106770, "uuid": "ce639a52-ec2c-41f1-a60f-85485b5ab92e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106770, "uuid": "cb3fe126-81ba-4478-8eb4-cd76f92fbf6b", "value": "New Quotation. pdf_______________________________________________.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c3e34c-914d-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617104842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104842, "uuid": "f9bb0ed7-25cb-4972-86a3-2cef5f89c8b5", "comment": "Malware payload (GuLoader)", "value": "ea16e959f9111560de4cab354aa0e4ae", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104842, "uuid": "72ee6b7c-4c1f-4bc3-9f59-14b0491c41b6", "comment": "Malware payload (GuLoader)", "value": "483858518fab8f8503cf5fd27e6419a8fa3bb6399d96fbbbef9f94b75fddcb70", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104842, "uuid": "fe3ec4af-b5df-4628-b286-6d8fa7560366", "comment": "Malware payload (GuLoader)", "value": "1d847fe68914504e06d2c0928dd91dbbf8ee895d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617104842, "uuid": "2334c4b4-7f25-485e-b837-befa8779d96c", "comment": "Malware payload (GuLoader)", "value": "3baf0524698cf2ec268b6706076eda0758ba6624bdc296029f51e4ad8c7a770345b702bba270fe2f5c50a63f5d1f83bb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104842, "uuid": "2a0594c8-7da1-4395-ba5d-102319a4026a", "value": "28E2F11C6C512B944DE74509B6B8A63EB738179923BBB1F5F08779E2313046F0DE1798", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104842, "uuid": "6485d553-bfa8-4e6e-91ca-111104d814a6", "value": "768:hctNFGewBYoFiLetqI/LuIMumlW3T35eUP5IUKe5gPHWBcZ3Fjpe4ob5l:utNMlBY3Lex/LylW3MUP5IUJmPf3FjML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617104842, "uuid": "166b06f4-5588-4f3e-b5ba-c68a6312d5bd", "value": 31317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617104842, "uuid": "163dbad7-9525-4e26-bacf-e1fc7f8b0cb1", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617104842, "uuid": "9c85e00a-bec2-4a4f-80d3-0ceb398d053f", "value": "New Order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fbd512-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126242, "uuid": "a57064d9-ba2d-4441-9997-2b3b59cf0469", "comment": "Malware payload (IcedID)", "value": "4411048fef0b2a587dbee16f1e858011", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126242, "uuid": "cf3df51c-1fef-44fd-be0a-c30fc2e9058e", "comment": "Malware payload (IcedID)", "value": "48623b9738ba622ba303967286a917e595da4d1f03f892b2cca39be7c8f441b9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126242, "uuid": "6adcf672-30f5-4d33-bd93-5c12402bd51c", "comment": "Malware payload (IcedID)", "value": "634439b7a528a90d3d79cb2f52268ad9268675b2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126242, "uuid": "a6e390e7-eb8f-4c17-8603-5cc1eb3cf14c", "comment": "Malware payload (IcedID)", "value": "b832e77ec174c66366ef89f2130fa6a80c27a7c166bebdfa222d76770876cca0c5949804e16b6d1b20be6ba96a60b7e4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126242, "uuid": "f0982287-6da3-461f-b7f7-e695a1879276", "value": "31B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126242, "uuid": "3df2665b-3bc6-4f0b-848f-c6cbdb2e7fee", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126242, "uuid": "526b0913-f7e6-46ee-8f49-b387eb8d24ff", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126242, "uuid": "9087330a-83dd-4799-b4f1-c7f77d6c1e0a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126242, "uuid": "b1ab56bb-9595-4ce4-bc9b-1ec29064691a", "value": "document-160537303.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da32b828-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120374, "uuid": "d544069e-1f60-4957-89bb-9da55336e702", "comment": "Malware payload (IcedID)", "value": "bba19b10a84ba60c26175ef41dc2760a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120374, "uuid": "e9512303-e423-4017-82da-55617caeff38", "comment": "Malware payload (IcedID)", "value": "4974d10d803aca30531d560b26f653c8e210b08d02cc0c94412d5cb7c218c36e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120374, "uuid": "ef660a5e-c91f-4793-9b99-d3daa9dc8431", "comment": "Malware payload (IcedID)", "value": "1cd9f850ef22d1382435762a7accc205af255c40", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120374, "uuid": "5c7a00c5-57a4-4c51-8007-04341a215431", "comment": "Malware payload (IcedID)", "value": "a9de479a711156c2ad6998aad209109793beb21a0fa023af1f5147fd5d6e7ba07f6f55e6917122a915370bd4e6370031", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120374, "uuid": "d8cd85c3-27e8-4c7b-98f1-9635ca17eae1", "value": "35135DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120374, "uuid": "94cfb334-abb1-4c76-8896-0fef19f0fd37", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120374, "uuid": "55b2bd52-d36c-4331-a534-ead5807dd833", "value": 44390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120374, "uuid": "d2704e09-8726-4e3e-b0f9-e72d24ddbbc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120374, "uuid": "31f09b50-660d-4aaa-9d2f-8d4c7a27d2ca", "value": "bba19b10a84ba60c26175ef41dc2760a.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de580275-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120381, "uuid": "f822bd9e-8505-4413-a146-5d96d6836678", "comment": "Malware payload (IcedID)", "value": "bac0f8a0345bb010469d341b6c6b0734", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120381, "uuid": "17606586-0289-466f-94e3-15ca49f09090", "comment": "Malware payload (IcedID)", "value": "4a0c09e7f76e59e6c0c3564ada755e4f336be5e2c0a619a53f3ff7df02fc0e35", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120381, "uuid": "6a405612-0230-4c53-8440-2591ee46dfde", "comment": "Malware payload (IcedID)", "value": "fa69cf5bbdee15107f22a4ce78e1aa018572cbd2", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120381, "uuid": "520ae6e8-3785-42bb-a08d-9796a9808e7d", "comment": "Malware payload (IcedID)", "value": "b686f8d6bfe9e3897c156fac201895cd963476dc44a07a93ccc7164f387e53e37042e30cae3dd6406ee6853057ed074a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120381, "uuid": "ba1174cc-fb07-4e6e-9fc1-3f201529dd0e", "value": "C8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120381, "uuid": "772c4262-488f-4e0c-a04d-0f200c633218", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120381, "uuid": "cf35b7ec-08c6-4e4a-9f88-49bf00defaae", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120381, "uuid": "90f95f1f-1a23-4ad8-a2bc-316f3d56e588", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120381, "uuid": "ddf093aa-c478-43c5-b444-f7863379b4e2", "value": "document-19491851.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d0ac36-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121519, "uuid": "0a69e9ad-5ad1-4b71-bf89-4ee5ff0bc63b", "comment": "Malware payload (Dridex)", "value": "3b97257c2b300222f0852f04936298e5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121519, "uuid": "b7e27606-b5a3-49a1-9270-0146a747e9fa", "comment": "Malware payload (Dridex)", "value": "4a3ba4682a230b0954607d0c00cfb4ecc8cce868dcdea23c330ac29361e9b7fc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121519, "uuid": "e9ca51d8-a3d2-460b-bdf5-0822b41a7b41", "comment": "Malware payload (Dridex)", "value": "240750ee593291663c1b98b996b3fe1b166d0baf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121519, "uuid": "afe52cb0-4901-4cd9-a94d-25886ed04a96", "comment": "Malware payload (Dridex)", "value": "9822b974b923fbe27767d739fc9e0278f780aa3a3037d54d2338568018ed9d7aba8dfae58f8a411273f7c5c549812415", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121519, "uuid": "300a8bfa-2d46-48ef-819b-8da60e229f0a", "value": "9C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121519, "uuid": "83c3a2f0-b304-4ce3-b7ea-c25d1a9d233e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121519, "uuid": "58d7bf39-a39f-4edc-aa55-2c898dd8ab39", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121519, "uuid": "0e3f67de-df4d-45f7-9cb1-ae333319110d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121519, "uuid": "4814da67-7637-43d3-9676-75e923e47702", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121519, "uuid": "3477a087-03ad-48a2-b113-3966e69ff8a7", "value": "4a3ba4682a230b0954607d0c00cfb4ecc8cce868dcdea23c330ac29361e9b7fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a028a81-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115354, "uuid": "313998cc-b8e6-4f98-b1ea-1cd169efcfef", "comment": "Malware payload (Dridex)", "value": "2eda7f721b35d46d53a957832d8912c5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115354, "uuid": "25c1f376-b3c3-471c-9559-effd6c3833f0", "comment": "Malware payload (Dridex)", "value": "4a5d16f0f01246c1b8a64ef0b4dbac6c4f3607afa5918b0ade8eb4963f237144", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115354, "uuid": "5f6c5f3e-89f1-4312-90cf-047cda4df75a", "comment": "Malware payload (Dridex)", "value": "d6b307003210705778825ec0d244e80f9ecc66a8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115354, "uuid": "d46f7b2f-84c3-4b85-bc12-082d1c69d585", "comment": "Malware payload (Dridex)", "value": "4c59e88e97f4c1dd577e8e9f6e51031147ca35f9fa698be22c1e299d11d5ddb6d014f919ca3c33faa6b8e523cb7b56ac", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115354, "uuid": "ebd40354-f785-4998-b8dc-dc41d686e88a", "value": "9714BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115354, "uuid": "f8a55b63-b418-40e8-83f0-46f57ae88593", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115354, "uuid": "6dbc74bf-842f-4036-b195-857ec903cc8e", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115354, "uuid": "199ad173-6596-4cc3-8f48-d39f7da371d0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115354, "uuid": "9305a0d6-1749-4cda-98b7-a06ac413d0d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115354, "uuid": "c80da399-0692-4a17-88b5-8e39ef4a190d", "value": "4a5d16f0f01246c1b8a64ef0b4dbac6c4f3607afa5918b0ade8eb4963f237144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053a9471-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120875, "uuid": "9c93cc03-b4d6-4527-b97c-01ccd2d668d4", "comment": "Malware payload (Dridex)", "value": "d5d5420eb7846d2d58a34fb5696908b1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120875, "uuid": "78ca65f3-89a4-4b73-a26f-ec8cc512f77d", "comment": "Malware payload (Dridex)", "value": "4abe35a64fcea53ec282db1742ac9c258bb8cdceea1a5e5e70f1d510b684f836", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120875, "uuid": "933f2aad-c315-47ee-b851-e7f494452650", "comment": "Malware payload (Dridex)", "value": "42edb3d188ce9f3828f6da98d6941f0a6b350803", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120875, "uuid": "92fd8b9e-ef19-4469-9aac-b22100556ce3", "comment": "Malware payload (Dridex)", "value": "86e4362352927db1abd45155eb17222741736876f731200b81abe3823ea5bbb2745868fb8f591bcdbc50ee176693edc3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120875, "uuid": "cb4a5cad-351a-40af-928d-1fab544e21e1", "value": "A314BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120875, "uuid": "700619db-3cab-4a51-8311-a8fa63591bdb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120875, "uuid": "47ac55e7-b356-434d-9ce1-6a7d7c09620d", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120875, "uuid": "ddb4d388-2db5-48e4-900c-b7bf543f363d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120875, "uuid": "98520ddb-cf59-4ede-a2e2-019a2b91e276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120875, "uuid": "88eed190-a7b0-496c-97ff-08eaf1d886db", "value": "4abe35a64fcea53ec282db1742ac9c258bb8cdceea1a5e5e70f1d510b684f836", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d07229c-9153-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617107172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107172, "uuid": "2ea4f621-5bde-4b94-beef-dec62f6d504b", "comment": "Malware payload (NanoCore)", "value": "ebab60f64d8ab1c9abed1f8f6bcdfba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107172, "uuid": "0c74d0a8-a1b2-457a-ac7a-6f2160d7f8a6", "comment": "Malware payload (NanoCore)", "value": "4ade4caf6c4b04143763c6fd2243d9d6d04ba39ae082a9034fce9fae0a219c6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107172, "uuid": "17652dee-6a09-4b17-9308-13fa4fe22d2f", "comment": "Malware payload (NanoCore)", "value": "dc25942ee4f7715550e7498c9b2a7d6de2900020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107172, "uuid": "2404f529-f361-46aa-8299-b13ab6ad6437", "comment": "Malware payload (NanoCore)", "value": "e79c44f8d233baaadd10994da581ee9cc3516625c0e4dfa72983d45a0f45e87618fe6d248caf96cdeeff4a903c870073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107172, "uuid": "60f00ca6-4b1b-4ce4-8e87-157f7fc1c377", "value": "0A4412043AF158BBDA7B2A3118739A3FE3FAE2040333552367392F645E6324755A918F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107172, "uuid": "bbc8b3e3-5c8c-43f3-94fd-44228a09acc4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107172, "uuid": "fa77e42d-9c08-42c1-a116-967ed4844d62", "value": "6144:FAP1EnCld6HgXMlUSCS8w/6uhGhgGDbogwdc01BA6c:ytnMlUaH3ojH4I6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617107172, "uuid": "a77ae3ce-23cc-4fec-b0cb-da8960bb5c56", "value": 255354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617107172, "uuid": "30d165f0-cf0d-4d5e-860c-2d89c859daae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107172, "uuid": "97e7eafc-6fde-49ca-9467-235f7c0883e4", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da52e6c3-9167-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617116079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116079, "uuid": "532d75c0-ecab-45af-b461-1caad9b7676e", "comment": "Malware payload (Dridex)", "value": "a04ccd8ae080ae091038532dd7f28ebb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116079, "uuid": "9effe5bc-5ba1-492c-9fd7-416b7862f265", "comment": "Malware payload (Dridex)", "value": "4b72e873d74330bb7113356bd485b57a38bef59e009cb07c9c2f48950a040c59", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116079, "uuid": "ad5c1c51-5b45-4e76-9f31-3ccb128688a0", "comment": "Malware payload (Dridex)", "value": "12882871df49d7c127ab2c4a38526f50b0586855", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116079, "uuid": "ba793020-c492-436a-a363-b62c6b2f2145", "comment": "Malware payload (Dridex)", "value": "88d643690af51369c16dad27db778d9e2e66036ef2234495712993b23e727720ac2d10484ab5516b8f4c2df5abe51f7b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116079, "uuid": "6b20ba8a-f17a-40a7-be70-e8801ce1b2b9", "value": "3614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116079, "uuid": "b04ed2cd-1327-4372-9f8d-7a8118ea9444", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116079, "uuid": "d50883bc-9b68-451d-bee5-ef3b548e4164", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617116079, "uuid": "e5e8a741-8502-4dea-90bf-e76e26cf5445", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617116079, "uuid": "b9576f93-be56-454b-a746-f61f3943c683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116079, "uuid": "cecac999-d83a-4b08-9f83-6e9230e2d325", "value": "4b72e873d74330bb7113356bd485b57a38bef59e009cb07c9c2f48950a040c59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8c3834-9158-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617109615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109615, "uuid": "443e49b0-f1c0-471e-bd7d-f21d9bb9be94", "comment": "Malware payload (AgentTesla)", "value": "1d1d01a0e924113a478f4d1786cd6ee9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109615, "uuid": "d9c0a434-7ffc-4916-b029-eba22d40bea3", "comment": "Malware payload (AgentTesla)", "value": "4b9956344bd9915a4f8d2154305e8185ce6610590861465530f46c209f52625c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109615, "uuid": "7279488f-accb-4b57-b6f9-e48631c48f8a", "comment": "Malware payload (AgentTesla)", "value": "9fa07c1b0cb362ddd2b9c61b65b9ef4df043f525", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109615, "uuid": "ea13064b-a55a-40c4-83b4-67ee8e293e5c", "comment": "Malware payload (AgentTesla)", "value": "bce6209704edbdd8a5d8c6805acbcae670d4b9f1293445fd124e60caa4a021ba1625fb3cbcb71b61d64380b5da108928", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109615, "uuid": "987ef364-7901-4533-9642-972debf081ea", "value": "1AE4B1A870AE405DEEB46734F5B585821FC925321F62FF3F28E657005CA3769FA4E920", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109615, "uuid": "5e3f3333-2462-4a9f-af5b-7eb396778257", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109615, "uuid": "7f5a6cee-2537-41e7-abcf-bde6d6893573", "value": "12288:v8vhR91czyvKSuVRkyyJ93OXra8aGAby:4hRDVuVV63OXr/a9by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109615, "uuid": "7a03fa71-9b7c-4913-9516-ed7f477ca9fe", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109615, "uuid": "f1f37a3e-c58a-45b4-b63d-6157874f6ba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109615, "uuid": "7d0d65f7-f5ff-4ab1-bef3-c481dcd6030f", "value": "1d1d01a0e924113a478f4d1786cd6ee9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51636c02-918e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132600, "uuid": "c0b58690-5ca7-4fb8-83d1-7172ce2b8e55", "comment": "Malware payload", "value": "9230a7014d77dd976099f5ee8fae84e5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132600, "uuid": "88abe39d-bc17-4ae6-a6b8-a5195eefa27b", "comment": "Malware payload", "value": "4bed38678c8d0b06ba783c6608c4a19954add4424c46fdba6844a9891e5dffe9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132600, "uuid": "e66c4249-42ce-49d0-b1ed-ee6d5d63145e", "comment": "Malware payload", "value": "011a821c4bb0ea150888e77ce23b21b2605f7ad0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132600, "uuid": "13d585ec-1a15-48ba-84c3-2237b240553a", "comment": "Malware payload", "value": "59e2aacb088771e3f2c00be20c688272972649b681ce17c803c67255fe3b12d8e4d37b3e11527f08a565ebcbd5b292d1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132600, "uuid": "fe0a7864-7e08-4c32-86ca-a25de67f3639", "value": "E514BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132600, "uuid": "3b638990-9610-4c5d-99bf-cf787b4dea51", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132600, "uuid": "6028a1df-1cfd-406b-9d2f-2598614edc2c", "value": "3072:/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132600, "uuid": "f2a5e922-91ad-4ec3-9868-e8adab0f85db", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132600, "uuid": "9b1cbdb1-887c-4ac3-8171-e0598e569d7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132600, "uuid": "887f361f-513b-4893-985d-8de976d1ec53", "value": "4bed38678c8d0b06ba783c6608c4a19954add4424c46fdba6844a9891e5dffe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4081e7-9193-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617134977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134977, "uuid": "07848161-07bf-4b76-8e96-6091668834b2", "comment": "Malware payload", "value": "fd16f440091d2a19f9c2f3d0a5f00226", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134977, "uuid": "813fefd6-b8b8-40f9-8781-dd6b1d038617", "comment": "Malware payload", "value": "4c4289c9e915f0b29cd5fd9c17a69f97aa0eea9a133e140eccc24d74867d55e6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134977, "uuid": "ba907fc9-9f1d-4beb-b941-2a0a690f12fc", "comment": "Malware payload", "value": "203a9986f4478f1f8ad60aa66e0babfa95505de5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134977, "uuid": "a568470e-6990-4d0a-9cbc-4b971daa0d9d", "comment": "Malware payload", "value": "de7246a44e55afe00ee6a1abd40405ff41b8343a0e59ccc4155b9384c3dbf7780337d8d8563121fccdae2888a900e7dc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134977, "uuid": "342e29f5-24ce-47b2-bc45-b417d5e1afab", "value": "FF14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134977, "uuid": "0ee03516-f1e7-430e-80ea-6b5ab7d24dce", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134977, "uuid": "38064b8c-ddf2-43e0-8cd6-5868abc0edd8", "value": "3072:L3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:LJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617134977, "uuid": "3bb16267-5c16-4f75-980f-e4d748148b2d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617134977, "uuid": "5702f5fd-7147-4c53-bbbc-30ea202bacd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134977, "uuid": "77035fe2-f8df-4a3c-b82d-deb1e07ac527", "value": "4c4289c9e915f0b29cd5fd9c17a69f97aa0eea9a133e140eccc24d74867d55e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ebaf4cc-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617106799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106799, "uuid": "170f377e-5832-4e84-840c-c6bdc0fe7a9c", "comment": "Malware payload", "value": "bc892f40c279c4a00f78bc4f5b35498c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106799, "uuid": "61bf6775-fdeb-487d-bcf1-aa3a20c68edd", "comment": "Malware payload", "value": "4c78169ece0a102dc5590e8f650ffcc67ca35f75ba0734a7c19a4bb8bfefd197", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106799, "uuid": "d521fc4e-c451-4236-920f-8cf8894963e6", "comment": "Malware payload", "value": "b19c8924c70c44096c8b55a0419c4e5b49618434", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106799, "uuid": "03140c8b-b0ba-4589-b09e-67073cdd7651", "comment": "Malware payload", "value": "7a8346a3dcf71201325d728fd8f55548971961c3278b75695649e2f1abee1bd4024ed8fb4e64be6183de21316aa2074b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106799, "uuid": "6c20210f-3661-45b4-8b44-ca7796a1e509", "value": "B4830278BCBF93F1D10B1C35A4E08717D5AA301CC5C6935728A626E65BAC9C81F07AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106799, "uuid": "8a3efce8-251e-4182-b6cb-35d2c605e9ed", "value": "1536:xFbcLgNoWHZfkPzgqSaK5yKobGPTTiyD+chOZXfjAv8VrjRvwpWG5kYN9O:xFbcmRtIMaKoKT+yichORkv+pwp3iYNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106799, "uuid": "b13c3e32-a57c-4e3c-8314-facbeb7fb629", "value": 86740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106799, "uuid": "8484a7de-2960-4310-bb27-c6610fe90586", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106799, "uuid": "364bbb72-0171-4373-b03d-d7713b14773d", "value": "RFQ_Quotation_33645.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fb5d44-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120793, "uuid": "db0e4006-9e1b-4f89-bc7f-fdc1681334bc", "comment": "Malware payload (Dridex)", "value": "e07a6c1d1859f1dd167f112465426c9f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120793, "uuid": "b2fc25b9-36fc-4b1a-bdb8-6ed5e1b38fe4", "comment": "Malware payload (Dridex)", "value": "4c7c4e116bcbd7a499ea58c4730328dbf78f7683c2974ff271b035d5c19eddcc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120793, "uuid": "b875d1d8-da26-4de2-a066-ab9492f97d3b", "comment": "Malware payload (Dridex)", "value": "beb9eff81be109c5d51990c1dd7a4af59015dbfe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120793, "uuid": "f26d8ebf-e19b-4910-b481-d233db11ca6d", "comment": "Malware payload (Dridex)", "value": "42d679b02c2ec2a07e130c22b5f066fb66d2ebd3193aa90867a7e3f57700e12cf70a0a4272c8261eb8090f4906e12f9c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120793, "uuid": "1359abf3-0640-4229-bc22-ee0ceca68b5f", "value": "4514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120793, "uuid": "13bbeed3-7187-4e7a-a415-141ec3f8fe26", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120793, "uuid": "60c3d82e-8c0f-4b33-8b25-0ebb163e37c0", "value": "3072:g3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:kJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120793, "uuid": "f893fc7c-64d6-4c4e-8e82-1b4dbf7d9eb3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120793, "uuid": "d96856ac-7d1d-4899-bfc7-33c8372c3ae4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120793, "uuid": "bf54ff92-f438-4439-8d8a-8a343e17c3aa", "value": "4c7c4e116bcbd7a499ea58c4730328dbf78f7683c2974ff271b035d5c19eddcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb8db2d-917e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125725, "uuid": "2f91c578-6144-46c5-a1b5-bf504e7cc654", "comment": "Malware payload (IcedID)", "value": "c44b0708ed6eea83eee5ac7c929c3f8a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125725, "uuid": "cf9d01a0-14ab-40d2-a12a-71cea4c6f5d8", "comment": "Malware payload (IcedID)", "value": "4cd62143ef6d71c66bfa2dc2ec35a675d0813ee0a4c3a0ca4c0f9721a0bbfc56", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125725, "uuid": "6725d4a5-b25d-4f72-b66e-98852da382f6", "comment": "Malware payload (IcedID)", "value": "6d57e6b237babc9a6ce263f846cb7df2e2993d1e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125725, "uuid": "6381ccf4-7841-436a-a767-01f1f012d9ab", "comment": "Malware payload (IcedID)", "value": "77e2d0cea2ea2d18c214febb14296f450b17a63f6caef13d3d95ad5a1b8989004c3988b045b614edd1e1b70fe745bccf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125725, "uuid": "410ec298-5d23-4e1d-8b26-f9f999e693dd", "value": "8CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125725, "uuid": "42951311-ac34-40d4-905c-f109153564b7", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125725, "uuid": "a78d32c8-5c13-4c1a-9775-ed82c74ab29d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125725, "uuid": "1fd4d0df-b09c-4a5c-8e88-929cbb9f480b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125725, "uuid": "d787b3ff-6fef-4bc0-ad22-1cfba01d7f07", "value": "document-1183561090.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55be7d70-9122-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617086221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086221, "uuid": "4dbf32d5-c4e4-4a90-bd87-cad6dc163ee0", "comment": "Malware payload (Quakbot)", "value": "6ce81c098e1eaa1477b3bf484bd55e21", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086221, "uuid": "69fa1fe4-f5e4-441e-929c-72bcfaf73444", "comment": "Malware payload (Quakbot)", "value": "4d276f93ac5b95e8e9c16476c9a95fe08e5a1d61c399a5d57a7b6cb4720f50f6", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086221, "uuid": "12f989a7-d073-4eb6-bd03-f555842a2a0c", "comment": "Malware payload (Quakbot)", "value": "6d8a18c31c119d4248d3021ba38b279ad55833ef", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086221, "uuid": "4227236c-c3de-4200-bef7-cd615ced1f75", "comment": "Malware payload (Quakbot)", "value": "d7cc729846e682b18a232f62ad38640767812a51d5d9d63299aa57ef66625c06f8af60915f81171964cd70d494f22157", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086221, "uuid": "0579084e-119e-40ec-b68b-3ce5bbfc0c8c", "value": "B8C3AE4EA144B45EC34FB53C5602A8E25C896096E583B53F25F07F086AEF2D31F9E5AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086221, "uuid": "925564db-74f0-473d-bf0a-8d9f3c2931c2", "value": "3072:PDt1c/LlVATdV/vEQSlcCGIzkSTPuI8+F:rt+zlVARd7ucCvT2Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617086221, "uuid": "be2e58da-6b4d-48cd-81ab-42f52a67a178", "value": 126532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617086221, "uuid": "2d3e3c06-411c-4ef8-9183-e4103e1dc0a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086221, "uuid": "997fb0b8-1f54-48ff-a693-54fcedd41951", "value": "licenza_1167.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eded649d-91ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617146177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146177, "uuid": "0a2cc609-3270-48ea-a65c-4e0d795ff27c", "comment": "Malware payload", "value": "17111569737803742486c6e1c5f61d2b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146177, "uuid": "b6b92c1f-1492-43f1-beed-c081c647d7ea", "comment": "Malware payload", "value": "4d434e306bad0c3b849b779dc8e120227beec8ea922ff2d99e2f9ca09fe3b2cf", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146177, "uuid": "0a0c3f25-e5e8-47b7-b8bb-54db0e14c131", "comment": "Malware payload", "value": "f18489f850c0248b86066fa8fc81c21528a38775", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146177, "uuid": "ddc6772d-af0c-475b-bdce-0375e556e024", "comment": "Malware payload", "value": "fa979bc24a162f5cbaa7b52bd3b082ae0c532836ca276a49e160cdc2d2b23530e01cf576dd0ab5d9263df709fbbf4ac8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146177, "uuid": "160e16f5-b740-468e-a671-ef77900bdb34", "value": "E614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146177, "uuid": "59751f38-46be-4962-924a-33b7c1983214", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146177, "uuid": "d12c717a-1a2f-47bc-8e96-d809970b52d7", "value": "3072:h3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:5Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617146177, "uuid": "8f838229-1c31-4153-8b54-e9b947f2575b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617146177, "uuid": "56fd6463-5ab6-4cc6-b20c-74e443b4136c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146177, "uuid": "c11c8ca0-4b89-41a1-b37e-7968c15e7f10", "value": "4d434e306bad0c3b849b779dc8e120227beec8ea922ff2d99e2f9ca09fe3b2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc15319-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "d5eff21c-a580-473a-a978-700e8b69a7b4", "comment": "Malware payload (Dridex)", "value": "845da885c2a37255a0152778890d58af", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "f314bf4d-54f6-4421-a3af-a8a610d0e050", "comment": "Malware payload (Dridex)", "value": "4d760eecf1b498e22935358222db5c14eed3066076be74ef91f6d2bb7e6e7e12", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "6b22bc08-a56b-4b6f-9a1e-d143849b6054", "comment": "Malware payload (Dridex)", "value": "b2b02496055ba79688469084fa198690d53f5f49", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114072, "uuid": "694a033f-7df8-4927-b5a3-f34e86db6e40", "comment": "Malware payload (Dridex)", "value": "ef80947da9a91b6e077e869f83fa0f59f5271ab27f56452df1f4acdd32e80737cdddbd570da8e0b04e7f319815062f8b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "43fc2c00-c7d5-453d-8823-54a2bbbb1592", "value": "6A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "ea963f6c-f719-43cf-be76-abac0c13ad67", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "7d2e4c3e-7c27-4c29-bc8e-660406ee4439", "value": "3072:k3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:AJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114072, "uuid": "a5c4c64f-ac93-4f67-a18d-1eedba227c7c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114072, "uuid": "4332b3c2-bbb1-4ba5-a6b0-8c82b56cd679", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114072, "uuid": "caa9779c-dd89-4373-b5c6-38ea7abf230c", "value": "4d760eecf1b498e22935358222db5c14eed3066076be74ef91f6d2bb7e6e7e12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb36c1fe-916f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119463, "uuid": "c738ff36-4209-4807-bc89-a4dccb159dde", "comment": "Malware payload (IcedID)", "value": "d26e3de2ca0d805764ab0a3e76c3fb01", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119463, "uuid": "ef0353ec-0698-4e3d-90fe-b3f9aededf3e", "comment": "Malware payload (IcedID)", "value": "4def78b9d0e941a98bc73de2b994e3b3f78a603493ca32e61e696415181c670c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119463, "uuid": "806a7b8a-098b-4054-a7dd-a2c48c025d23", "comment": "Malware payload (IcedID)", "value": "cd9adfee102b283fca00cb8828fca7da095d8de9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119463, "uuid": "9209298a-2e42-4402-9543-887a3e205c3e", "comment": "Malware payload (IcedID)", "value": "1756a0fb6ea771e6337e63b7b154679b22506a3445811a95b5234e5785245ccfdd74e5354b9c374c11e838f19ccc728a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119463, "uuid": "ac749319-366e-451b-91ec-8560ac517f0f", "value": "55B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119463, "uuid": "205c9f7f-2d71-40df-8ff7-86a712ad915e", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119463, "uuid": "00b5ba55-0bfd-4691-913a-ea7d329e7da0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119463, "uuid": "51f13766-e495-490a-bfd9-95530e9fd13f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119463, "uuid": "aec96dc1-a0e1-4c32-8530-e80f7c0a3580", "value": "document-1872036283.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593e2765-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114144, "uuid": "975e7dd1-b5d2-4af6-afc9-22f95a2a0b11", "comment": "Malware payload (Dridex)", "value": "1ae66fc29f43c004d7caa4b750c00907", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114144, "uuid": "a1a00dcc-62b0-4c51-9d09-305adde41a73", "comment": "Malware payload (Dridex)", "value": "4e4613b337025b361a66fca1d1e92f4f4e5f5967dcb4e4656ad85c3463dbbd50", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114144, "uuid": "76bc9cf1-b7b2-4b62-b0fe-14810ae262d9", "comment": "Malware payload (Dridex)", "value": "aba061dc2873c95634cc6f55d5855b0397cbf540", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114144, "uuid": "0ad57ddb-da6d-4fe8-9e19-02a33f593d31", "comment": "Malware payload (Dridex)", "value": "8de9d5a3360b0922c1d30737f9694eb76d86a7f628ff9de7ae6966944eea6f3a9dbd04c060f1f7f84235dd22c0ccf1e5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114144, "uuid": "790d4667-10c1-4953-851f-67a8b2d96fa5", "value": "0114BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114144, "uuid": "0bac9f24-127c-4ade-83f7-31bf4c693a1c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114144, "uuid": "e1d87f4e-1b4c-40e0-833e-1363e31827c0", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114144, "uuid": "1ac7195a-b303-45ac-9010-060ba49e8417", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114144, "uuid": "36eba244-8957-4cf7-99f6-f427ccc4db87", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114144, "uuid": "0bd8a51b-d2a1-4ecc-a94b-20be274b111a", "value": "4e4613b337025b361a66fca1d1e92f4f4e5f5967dcb4e4656ad85c3463dbbd50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f720dd42-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114409, "uuid": "350c1f44-dcc0-48ab-a209-c098353ad8db", "comment": "Malware payload (Dridex)", "value": "c449d800e73aac253f05f54fa1190089", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114409, "uuid": "5b19f63b-d80a-40e9-94ea-da0174679057", "comment": "Malware payload (Dridex)", "value": "4e81da72d42b908e5ce68381b6d3e000c82f5c0b314e1d7e3d526ed3feda0b54", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114409, "uuid": "179b547b-45de-43ac-87b7-5dfcb64012a3", "comment": "Malware payload (Dridex)", "value": "c257707d75669994ca6e44824f54db873794a1fd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114409, "uuid": "1423ddba-9350-4d8a-a41a-4eecc1760166", "comment": "Malware payload (Dridex)", "value": "333b58fbc467ad660a5bbb0345a14cebab3ed3ab216fe12e71553c46b45332a9baa699e31fd2fe8b2e6d77d3ce528030", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114409, "uuid": "86e7a8f9-4699-4cac-869d-e02b77f053bf", "value": "9E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114409, "uuid": "d90888e0-f68c-494e-bcb8-ed47fcb2a24d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114409, "uuid": "565d48c5-67ae-490c-9467-13e73d539686", "value": "3072:O3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:qJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114409, "uuid": "b22ddfa8-d253-414e-9a6a-e32d5df0765f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114409, "uuid": "ff211266-6b83-428c-9e24-14b27d009296", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114409, "uuid": "b68461ba-9930-4e10-a745-06ea31f03313", "value": "4e81da72d42b908e5ce68381b6d3e000c82f5c0b314e1d7e3d526ed3feda0b54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94b2abf-91b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617147914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147914, "uuid": "0f97fdc5-b12d-45a1-ae5c-242fe167ee6c", "comment": "Malware payload", "value": "f37551473ab223a8e18744c9d7542732", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147914, "uuid": "e9c423a2-10cb-4fb7-82b5-efa120fd1dd9", "comment": "Malware payload", "value": "4e955ca30acfeb98f99c2f32a4b78c4967fcb43a58e88d49be0b03eb13220941", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147914, "uuid": "f641e4fd-6eea-409d-891c-2eb8ac0b6ef7", "comment": "Malware payload", "value": "e8c6e2c52eaa3ec503e3af8b4a32e429f6b8e346", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147914, "uuid": "ab01721f-1fe1-49f1-a890-d3dcd793aa73", "comment": "Malware payload", "value": "3eba31e8d7974d7b7f833670d561dda3855221fdb0958965f4954e129501a67f6263204a202f0e7980b6ace8e4211d86", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147914, "uuid": "f239d4b1-e26e-4d71-a80c-ce155eb6f12c", "value": "DD14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147914, "uuid": "b186ab3c-4ec0-46e2-837f-82b38a1d5f06", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147914, "uuid": "a0f481d3-59c7-48d0-9923-19fd5ac154d3", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617147914, "uuid": "177277fc-3a63-4936-a344-6bcc70f86f9c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617147914, "uuid": "0e7775b7-8237-4dd9-954f-c22122fdc9b3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147914, "uuid": "0cc07e7d-f387-4c03-b01c-b5a788737725", "value": "4e955ca30acfeb98f99c2f32a4b78c4967fcb43a58e88d49be0b03eb13220941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c7e4ea-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120935, "uuid": "f7f476f4-52cc-46dc-8a26-087542bfc676", "comment": "Malware payload (Dridex)", "value": "9b9aa5cd55b4daaa12cbaecf92b265cc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120935, "uuid": "210b9719-1895-4fe0-920c-dcf6a872a69a", "comment": "Malware payload (Dridex)", "value": "4eb601da34714704472b177b2cbbc80e5996c96954a09ea806b2969e0aefc355", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120935, "uuid": "0327132e-dc9c-4673-b2d1-94c139709d4b", "comment": "Malware payload (Dridex)", "value": "544e6ba785d37a8a93f2d83392bf59a0e04513c6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120935, "uuid": "3c126e36-bb1a-409a-98d0-357f965e2ce5", "comment": "Malware payload (Dridex)", "value": "95e65afbe9a3899dc4ca492b98da00be0159edc5fbd6fbd16283d1aadc8d165e53b4ed959b73f090d7a8bd579bcfc015", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120935, "uuid": "0b6e1a8a-b2fc-465a-951d-633f764cce7c", "value": "D314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120935, "uuid": "2cb84649-1c55-488f-be02-fcec8e05f904", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120935, "uuid": "422a54da-dad7-470c-a522-144e5013946e", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120935, "uuid": "a838cb10-4219-4ed5-88ae-ede90952766b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120935, "uuid": "b37fd042-86ec-4346-9b27-c111b63326af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120935, "uuid": "cccd40d5-3543-44ac-9a61-6b4ad9e9a34c", "value": "4eb601da34714704472b177b2cbbc80e5996c96954a09ea806b2969e0aefc355", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb1bbea-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122794, "uuid": "5fcbc4dd-36bc-4ea2-b8b5-f64d7a2d38ab", "comment": "Malware payload (IcedID)", "value": "e0911a2b4f77153aa56c8d0c4197d041", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122794, "uuid": "3d52bdf5-f137-467e-994c-369577824db1", "comment": "Malware payload (IcedID)", "value": "4f716c042049c65f7f5b3ca1729be3796ac3df3c54c6ad2c0efe79db3baddd51", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122794, "uuid": "edc54219-954d-46fc-84b3-c3e55b47fcb0", "comment": "Malware payload (IcedID)", "value": "e86df6c9427d4a919014b84081773a0abb4fc9f0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122794, "uuid": "597a4ff3-5287-4bc6-824f-2bede7046997", "comment": "Malware payload (IcedID)", "value": "6360d1e92a7d1f8d86c68b750df02e3f00500f646575b168f9be696821d487159393c6885074511497b931594726282e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122794, "uuid": "4f58f093-a9da-42a2-9887-91ef96fc812c", "value": "29B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122794, "uuid": "90690472-4564-4b2a-b767-b704cb964e92", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122794, "uuid": "aefd7367-f87f-4ff8-bef7-b4f9cbb66180", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122794, "uuid": "f9a805dc-307a-4024-93b0-f63078709d42", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122794, "uuid": "908a8994-985e-4bb8-9044-587e55de399f", "value": "document-1155604254.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21801458-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126936, "uuid": "7b167396-2766-40d9-9c24-d58f211d415b", "comment": "Malware payload", "value": "a416b52af732936d9a9edd09db015df6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126936, "uuid": "a15f2f4a-5bf0-4fd1-be2a-f5d90c4a545c", "comment": "Malware payload", "value": "4f990b3ab2e37d4aaec4c257222016d880285fcf0fe02ec42040de3e9df8d377", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126936, "uuid": "dd91b10e-e256-45a1-ab83-889b787dc838", "comment": "Malware payload", "value": "3e0fccd7cffbe10fa0df13b765429a1a5c35ff7e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126936, "uuid": "1ec282fd-9f83-4adf-8cf5-befefabf3f37", "comment": "Malware payload", "value": "bf00f08328f6995ff640e02efe0dc685310d32342844b8a0e63dfd572d5bd0b73e205bdc87f4e4293e898d2a8c2b4f0e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126936, "uuid": "73133982-d68d-4c30-894d-41f399217612", "value": "6C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126936, "uuid": "36eb68df-94bd-4026-849b-176060d0ed17", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126936, "uuid": "70bd982d-c14a-46da-9ea1-006c476b37e3", "value": "3072:/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126936, "uuid": "36dc21dd-2e18-449e-974d-603bfbb0fcf3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126936, "uuid": "77fcd084-511f-4315-8015-fe0ecf62e006", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126936, "uuid": "1e83c48f-adc1-42ab-aec8-adcbb652be75", "value": "4f990b3ab2e37d4aaec4c257222016d880285fcf0fe02ec42040de3e9df8d377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ac5505-916a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117326, "uuid": "bc7e55d1-8ec6-414c-b274-7260d226b948", "comment": "Malware payload (IcedID)", "value": "28e4577d5c59e12ea7e012adeb6e4301", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117326, "uuid": "7d2e82cb-bc6f-4b4d-b3c4-a17dbb76616c", "comment": "Malware payload (IcedID)", "value": "4fdafcc731fc36ba839023c9648b923c8fe14578eac2a6f922a95d9d1c5602ad", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117326, "uuid": "e7535a2e-c537-471c-86d7-22fd7cd720b7", "comment": "Malware payload (IcedID)", "value": "a52ee26d92a93f3c9168998bc15a5a8dcf1efe20", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117326, "uuid": "3d693416-9d9e-4a29-b6c1-a01cdcc153af", "comment": "Malware payload (IcedID)", "value": "9f1683b62b15bebc2c05e93624fd8e7aba9f44f09daf736558525cc764d2f0c0d11b8a7822113dd8e36907d432fb3da8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117326, "uuid": "721d6ad6-006c-4096-a90e-6fcaf4fdb68d", "value": "62B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117326, "uuid": "8ef26be5-4912-48c4-bf48-de8ac13a36d5", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117326, "uuid": "d64d0042-9557-4e07-ae11-7d68c41a5ee5", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117326, "uuid": "b2beb1b0-4d2d-42d8-897c-0c104f79d87c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117326, "uuid": "d889c43d-a0fc-45ad-a0f8-f71eb1b078eb", "value": "document-254433920.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa093ab0-9158-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617109556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109556, "uuid": "419708f8-6111-4753-8a72-504520734d9c", "comment": "Malware payload (AgentTesla)", "value": "a0d209d4d0cbc88a45361016ea896c2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109556, "uuid": "33010411-96c5-4299-b195-0e187bb1a17f", "comment": "Malware payload (AgentTesla)", "value": "4fdd92735b2a9257c1ee30b01beb62b5525db4893f0ce605b1785f71b803f9f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109556, "uuid": "d6ee2ff1-9f43-41fb-8c11-d5aa9f4124cf", "comment": "Malware payload (AgentTesla)", "value": "47c31ceadf8e5adece10fa6952785515fdc5a175", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109556, "uuid": "858fbb80-cf70-4f5d-8110-c599bba11f87", "comment": "Malware payload (AgentTesla)", "value": "096ac8bc156c0432d3fe80ca25696573be4e65b1d2571126c0197477d782b6a9524e8499d9772a1a53b4e606e72ecf56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109556, "uuid": "def09e1e-27e2-4e5a-8e2e-bba48fc92f1a", "value": "A0D490A870AE405DEEB46A34F5B595821FC825321F52FF3F28E657006CA3779FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109556, "uuid": "ee579f9c-30c6-4e63-a5be-9ebabea0eb97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109556, "uuid": "a4839959-0b0a-4104-b77a-205e4f73505c", "value": "6144:naca5BbNZvrM9QxAsEBq2fPdA26Ia00v4csAV3qMhCpa9FQuLUrusljAVpfhZb7+:QTrEBDdA2jAv4GUdoFQueJlcf09nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109556, "uuid": "476337be-260f-4ecf-ba5a-7192f93771ae", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109556, "uuid": "72d7319c-d066-41de-ba35-702305d31fd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109556, "uuid": "1e56a03c-1c3b-47f5-97e9-7b3f8c180664", "value": "a0d209d4d0cbc88a45361016ea896c2d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab6301c-9124-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617087250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087250, "uuid": "438cd1da-071b-4800-8203-ae5c80096ac3", "comment": "Malware payload (AgentTesla)", "value": "32b74499aecb7fe0b4c1badcba5757e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087250, "uuid": "128c26cc-69d7-4558-92ad-a5d6a7e478e9", "comment": "Malware payload (AgentTesla)", "value": "4fe0cf5ea4078adae2170d820443a1a8d91d1eb6dbf886db70783998ffd65d0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087250, "uuid": "4cf1a816-2018-4d3f-be89-0ad7568ee125", "comment": "Malware payload (AgentTesla)", "value": "1bbb24f21a099640cbf1cb7fb3273e7fce5027f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087250, "uuid": "bad67f81-e06a-4a0f-8016-01563b4701a1", "comment": "Malware payload (AgentTesla)", "value": "a42bd4f26a8a55e1c20d7367b6ec5c9c0961a53b59d972a1483182ea039fef66a1d4f463c40ed5b9c2f6db599ba9cc80", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087250, "uuid": "828c96e7-8e77-425d-9631-f3df59d312c3", "value": "CB638CD22B446B4ADA4D943D436AB37F57218F61D40A6FD0488E52F7B2DB610270ACFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087250, "uuid": "a9f55fae-e054-48ec-8345-0cffa3da806c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087250, "uuid": "2b77699a-b6bc-43d4-9ce8-15609dd7722e", "value": "768:1ycXXWHzGXxNw20GsoBUnOd7hkJBLs5edoyXhmaz:1yAmKhNwNGsoBUnOd7hkJBL8edoyJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087250, "uuid": "69e7782a-bbd7-4ad7-b1bf-3541ed9d0f64", "value": 72848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087250, "uuid": "655d69a2-e8be-43ab-8442-0da0c7f54a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087250, "uuid": "66dd6b01-adca-4a57-a45d-d0c52d34e358", "value": "32b74499aecb7fe0b4c1badcba5757e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3ee014-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "5d090d35-0fbd-4d28-9bd0-0e8c52d62157", "comment": "Malware payload", "value": "b15a55f1e429a0d539fbe077565c267f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "e8e46399-ab98-436e-aae0-1a185e2fe0aa", "comment": "Malware payload", "value": "4fec26497f5c299c3575238ea4c76654f8a8f554242c402050c1c75f5d5d61d3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "0c9e786c-5b35-4a52-a6e9-cebb7410f127", "comment": "Malware payload", "value": "0f90c0b44fd3ab53fdeca140c23e48d18be0edba", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "32e3cd95-40a6-402d-90c9-947609f6f7de", "comment": "Malware payload", "value": "6a6d18de62a4fae0e1d9fdd63f6e1e10684fc94b935e45e7f246e31febf05c9f8b0b2db4b94dd55b2dd9f9ce47d3347e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "3b2a2f87-39db-4a70-ba98-b3a11e901245", "value": "2214BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "be174fe8-ba9d-4539-8843-d3d96abc3a1f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "e5d530eb-300d-45ec-832c-47b093fb6162", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136507, "uuid": "20d79fdd-05b4-4446-975e-28eaa3160d34", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136507, "uuid": "4bb0c7d4-d7ac-4b8b-8089-cff312d7fc7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "8499afb3-e7c7-4490-9b3a-ae03ac842a8d", "value": "4fec26497f5c299c3575238ea4c76654f8a8f554242c402050c1c75f5d5d61d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d28382-9124-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617087129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087129, "uuid": "9920bdaf-fcf6-419c-be34-493ac88feac3", "comment": "Malware payload (NanoCore)", "value": "65f02385fcf4d6ee88ece964c6ed5968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087129, "uuid": "92c821bf-e60c-4ed2-86cd-634337fed0d5", "comment": "Malware payload (NanoCore)", "value": "50358aef1dac728a0dbc96dfb555ac4d4b91b3761785e1abfe5ac2638816ebca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087129, "uuid": "62b33b9b-c3ba-4402-bc7d-768219a8db83", "comment": "Malware payload (NanoCore)", "value": "c0a90889542d04563cf9d7ba40294e352c37046e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087129, "uuid": "062cc830-f95c-4024-9ec3-8154242e2ffa", "comment": "Malware payload (NanoCore)", "value": "8bd5c160df974caef70e6d5b79a4fbbf462bd3bcfa31a3854dc1dbbe83e8dee0ca23e21c33afa6702e600c6f2bbf55d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087129, "uuid": "f5fe2700-90fc-4e1c-8387-635826ab53bb", "value": "2F25C48C2D9AC1DAC6390B7842C9C4FA46E95FF34F12887AB9C45FCBF431745E60A526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087129, "uuid": "415119b9-f5eb-454b-886c-22bebec2a9e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087129, "uuid": "feebccec-9fc9-4760-8e9f-03dde6fffd8f", "value": "12288:eTj0BH9P9qh2iNzFUcMH50NeOBEzuObIxjTyQZOp96kGls0oyw6S4h:40BH9P9qh1s9H50N8zxdpfmspLL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087129, "uuid": "626595fe-7e61-4de8-8d4d-c89ce2d54a29", "value": 1016832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087129, "uuid": "29173ea6-d25d-48be-aed1-234770d796c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087129, "uuid": "7451aa88-e431-49ef-98dc-ee86b10b04de", "value": "65f02385fcf4d6ee88ece964c6ed5968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9033ba-9193-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617134898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134898, "uuid": "06a0207c-265e-4d70-aa30-45106be515ad", "comment": "Malware payload", "value": "e74f411c639bdf2b2ee8d9c07dae9e1c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134898, "uuid": "b536f50f-3214-43a4-9537-7dcff1d07181", "comment": "Malware payload", "value": "506d1305488252100d090cfee7f5b7a790064190feee001cfe50e21f20e040b0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134898, "uuid": "b12492a2-0964-4b56-81e2-6d3707e86c22", "comment": "Malware payload", "value": "84205c52a57a7bf6bfb2052d1de4daffd4a6b88d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134898, "uuid": "b3eae358-becd-4ea3-b121-57a0f9354054", "comment": "Malware payload", "value": "d53bcad60254c10df0bfca89e65e0e0b0c90a99f0d0e4bbd39110ea99949a20d779958592ccccf492a21d9d949fc844a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134898, "uuid": "cba0cec9-ea10-457a-ad86-cb54670d3c36", "value": "0514BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134898, "uuid": "9a66af61-1354-4654-8c47-da1639882403", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134898, "uuid": "77411108-beac-43e5-972d-df77353eaa35", "value": "3072:Q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:0Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617134898, "uuid": "dfed4028-13f4-400b-b864-eb19a0bc7fa0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617134898, "uuid": "7aae7246-1084-4845-af04-9cb864b8ee3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134898, "uuid": "93813943-5d2a-4a56-a7f8-40663e9157a3", "value": "506d1305488252100d090cfee7f5b7a790064190feee001cfe50e21f20e040b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d031e9-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115696, "uuid": "720819dd-7e62-42cf-9dba-e0efe1358d0b", "comment": "Malware payload (Dridex)", "value": "12adfcaa98654de5e4e2c3b1078d107f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115696, "uuid": "a5441353-1398-4413-9bd7-dbdfda8b6127", "comment": "Malware payload (Dridex)", "value": "50a20cb680b56999c4fc386c3a28336bd750267d3eee7c6419fefc5bace2be2d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115696, "uuid": "3077595b-b9b5-4fea-a2e6-44d86bce16d8", "comment": "Malware payload (Dridex)", "value": "2b8061794528a395c69d7d8a990d8013fd2c3503", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115696, "uuid": "72280aa5-0356-4bc2-b0f3-25c820a77cf9", "comment": "Malware payload (Dridex)", "value": "5f06d2cb17518354b1ed2347d65f2241314f56c75becf2bf20a869d7788c7b1d24a6b7ad7af97dc4baa4a74e1a575ee9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115696, "uuid": "46ba9edd-495c-4795-91bb-da3561414b89", "value": "FA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115696, "uuid": "1cc02bf6-3f2a-49bf-b674-ddbcc9c896d3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115696, "uuid": "1704ad07-ec66-4a48-a090-10c0e9d386c3", "value": "3072:93PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:9Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115696, "uuid": "ff30a31c-9fb7-49b6-b577-63ef418d6393", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115696, "uuid": "440da1f8-507f-457f-a856-4cb944445d9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115696, "uuid": "b0a86035-fbc3-4d3e-911d-d908c87634f7", "value": "50a20cb680b56999c4fc386c3a28336bd750267d3eee7c6419fefc5bace2be2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f028a9-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "77317692-8b0d-4405-8710-32f090213e36", "comment": "Malware payload", "value": "2167c0f4caf4a13fb6e652d1e51dcc56", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "e4605eb6-c132-48ce-bc40-ca1631bdecc3", "comment": "Malware payload", "value": "50b908a587911fd3df2977902fae6ed9c92379c25ecf8a65d1d9e862c181b2c4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "ab40bf77-55f3-44e9-90f0-dc1042407724", "comment": "Malware payload", "value": "4e1717b1ecbd81d59ccadb6a7390de9e233d31cd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "a4f9061a-5a68-4568-a088-1d48e434c3ac", "comment": "Malware payload", "value": "17b4bb756b3701189ae01ccc2e166e98d48ba6137fa6bbf9fc1a999f171acdb045290543b696c2fbc55490bc310e8183", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "90af967c-b976-42ae-8e89-acabad568d07", "value": "8014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "5f58b819-f6c1-4c64-bed5-676e159df714", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "9acfd6ba-162f-4a1a-99bc-fbd8cde953bf", "value": "3072:w3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:UJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143749, "uuid": "c4d0528e-91f1-49f4-8c7e-381badc73da9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143749, "uuid": "13ab08eb-8137-4eaf-8376-df034f223b8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "3f8dd787-e967-46f7-b761-05d59fc0d5c8", "value": "50b908a587911fd3df2977902fae6ed9c92379c25ecf8a65d1d9e862c181b2c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b15314c-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137206, "uuid": "2600335c-7cad-497f-bf67-c82ef9384131", "comment": "Malware payload", "value": "dc8d1763959f01449551d776e4ca489d", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137206, "uuid": "ad09092e-05d1-4c88-9a42-cfea7c56edc2", "comment": "Malware payload", "value": "50e86c5555e11ef2c8857ccc4a49e90fa42163b5a6f8f42ec43b54005a63c38d", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137206, "uuid": "cf0a8970-17b6-4a1b-bd7a-35ed14d6f408", "comment": "Malware payload", "value": "741d0b9d5fc2503558892489acb640265f198d0d", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137206, "uuid": "5ee03950-5acc-40e2-a7c9-e3dc2698e821", "comment": "Malware payload", "value": "43358fd7d59c1a0984593fa8d521e6a820dcbe55df30ec582827601e138093c78ae8ad2a33314eb56d3a334336ef2769", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137206, "uuid": "28640d52-7ffe-4930-8e50-5efba0fc2d72", "value": "16328D3DC54EE460C972C178709912F6FA4D8606A662D13BB457F8D9C864977033EB8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137206, "uuid": "0a0e4a68-0b93-4c0c-9648-478818f28653", "value": "192:CtNCWUyn0i13pNXqkOcPiYFLwzvdX6Ptpwjnw+umHBCAVVQ:aNxUyn0i13LROEiOLkX6Ujnw+3BVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137206, "uuid": "4420b0c1-d606-4fcc-8281-cc63b6061c96", "value": 11726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137206, "uuid": "bca73c45-fe36-470a-9d77-94499bd0cbd7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137206, "uuid": "8f2ac199-5246-495b-ac87-ac177ffdcc5b", "value": "Customer Account Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "587b90b2-9179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123592, "uuid": "339359ce-5118-4958-b59d-de80b6283044", "comment": "Malware payload (Dridex)", "value": "433f6a1201bf296e36e07857fa99f7fa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123592, "uuid": "f927dc6e-074e-45b0-9d4e-1cb54dccd4b2", "comment": "Malware payload (Dridex)", "value": "510c0d0257685ac4bae1d5d072eb6f8dfabaaa87e45ab1002d8fe95f1715e863", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123592, "uuid": "f3ca2895-55df-4f31-8c9d-38f3f198d96d", "comment": "Malware payload (Dridex)", "value": "fb61ad852072da7725cecd20d4f993cb01f9ff5b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123592, "uuid": "c7c6367b-2076-4687-9c47-d71ac901fdef", "comment": "Malware payload (Dridex)", "value": "9eb86864cb0a42419c03e02a1ccf33f432bfd15017fd5d21d2edd7337b2b3e6b9bd2fb6a4c6341589f3c39bef070f153", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123592, "uuid": "7ced3664-e02c-48ac-b3a5-3816e2aa406c", "value": "C114BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123592, "uuid": "f708e626-2374-44e9-a79d-ad21e956d618", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123592, "uuid": "29ece0e6-4304-4d14-a38a-49e2e980db75", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123592, "uuid": "e9019dea-499f-401c-8ff0-597b24e74576", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123592, "uuid": "80914f9c-f5f9-4cbc-9327-e369ce8b94b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123592, "uuid": "5fb67638-cb3c-4e22-aba8-a6de8d73d9dc", "value": "510c0d0257685ac4bae1d5d072eb6f8dfabaaa87e45ab1002d8fe95f1715e863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2e221a-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "362ec086-e2a0-4653-98f5-5826c45b2689", "comment": "Malware payload (Dridex)", "value": "e6f633a9afaf3cecdfbf10d32e9b20c0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "82927109-d0c2-427e-8c29-b3b3cf069e1e", "comment": "Malware payload (Dridex)", "value": "512bfceaa4e654cf54b7b0768e4761965f4bb9344e891b53ccc372656dadff3b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "c679e473-af40-4f14-bca0-4c8802dff2d1", "comment": "Malware payload (Dridex)", "value": "769e2dc43f824648b9077b09c803e9aa8512624a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114393, "uuid": "24e49e2a-d913-4fe2-b298-1df6d1c4868f", "comment": "Malware payload (Dridex)", "value": "bde3658d1319f9ef9634937eabc871c96b45a3e1bff5ce276292e466fdcd0ae1faf400e658e4b93131404d7803324270", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "4f616c13-358b-405b-b927-95d12ccca7fa", "value": "4814BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "34d66a27-075c-4d40-ac92-31817f37e57b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "884c125b-2567-4f3b-b5fc-7c752d966a51", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114393, "uuid": "78126cc7-72ce-47b5-b70a-327112846d44", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114393, "uuid": "2e70eb5e-d6f0-4861-8f77-b2a5100de65d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114393, "uuid": "77c21b6e-c7cf-4ae6-92f3-cb550a53c8d0", "value": "512bfceaa4e654cf54b7b0768e4761965f4bb9344e891b53ccc372656dadff3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b9b2ed-9182-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617127364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127364, "uuid": "37ba1473-40b6-4d01-a53d-733f1cad0502", "comment": "Malware payload", "value": "8130358bf704bf273ff36fdf44e0d5fd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127364, "uuid": "33f41367-1dac-4997-8ab3-a252dbdbab6a", "comment": "Malware payload", "value": "51a39d65317bcb3da449776f2cdb6183e84c116988034ce58324d5620028e84f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127364, "uuid": "0c7342dd-aa62-4f68-ad65-d30e3877ab9f", "comment": "Malware payload", "value": "13608d777a2fc199b52162b7533ad73a2ccc86f6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127364, "uuid": "d11e4cff-8e75-4167-8156-22b976337133", "comment": "Malware payload", "value": "7b301f8ef9c9849652edfef4ec280397b15a23974d0260a915a28161f15f71aede5b34d3cd93cc1566be047716ae6f5a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127364, "uuid": "e1e80037-124f-4cf1-acef-1b77bf06c03c", "value": "2514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127364, "uuid": "4b585e1d-a14d-4b51-b637-f8e0f99066ba", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127364, "uuid": "af907ec2-432a-4f8b-90f0-6d3a0f1cd373", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127364, "uuid": "44712cff-2c92-4efc-a9fc-610072364642", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127364, "uuid": "733d3efd-8f7b-4804-a82b-685c1cf4559f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127364, "uuid": "868117d1-b62f-4492-8532-e545fe8754a5", "value": "51a39d65317bcb3da449776f2cdb6183e84c116988034ce58324d5620028e84f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55f78bf-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120715, "uuid": "c6904ada-d517-483b-a734-b658936ca558", "comment": "Malware payload (IcedID)", "value": "7e12740042cd80b131a0724fe0946c4c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120715, "uuid": "23888b1d-60b9-4512-af6d-11fff0a8f578", "comment": "Malware payload (IcedID)", "value": "51d5f805abac585c1cb686c3b87d1597a8ae66c0a3a83f15a5f3143a1197b8e4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120715, "uuid": "8d7415d0-4e6c-41dd-9985-a4b5d7d10f5e", "comment": "Malware payload (IcedID)", "value": "35fa6443db566d5ccc547449c6bf122149c01755", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120715, "uuid": "b70ed0d0-5e1c-41a0-b578-411d20e875e2", "comment": "Malware payload (IcedID)", "value": "d879df0a9b494e368fd996feb08058f1b6917cb00cb6e6835173e41a1ac8d37c7e7f793f8ba607e72a80199d97612ad7", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120715, "uuid": "4549de64-cb3c-4257-8c2e-8b7ccd7827e5", "value": "6BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120715, "uuid": "94cf4d3e-7075-4aa5-841d-8fdc45b4c9aa", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120715, "uuid": "3ab9d244-d717-49af-8d62-2046511da01d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120715, "uuid": "7e582d36-9ac4-4556-b669-a71790c42270", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120715, "uuid": "08f66455-16ed-408a-9517-6b4f575e48d1", "value": "document-1064933657.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4c1244-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126556, "uuid": "71f78900-a334-4d50-ab91-002e66f83050", "comment": "Malware payload (IcedID)", "value": "b90d9124ff077cbcfcec9853f7135a8e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126556, "uuid": "7e89016f-34af-4dbd-be09-cbd323215abb", "comment": "Malware payload (IcedID)", "value": "52112a674d7751e1c068ec93789775082ffd6079ee944bb35db8095dbd995b80", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126556, "uuid": "b03a03be-0eac-4cfe-b015-74b36f864bb8", "comment": "Malware payload (IcedID)", "value": "ba84ef57aeafdc5a7ae529c3665b09eb378f0d9e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126556, "uuid": "5176199d-9e9f-4ed2-810c-e35fc2e3c146", "comment": "Malware payload (IcedID)", "value": "1d442bc45be6977db1044d358b99c2e9845ca279642fc923b979905aa34cc6f859db1b718f30a391793c210b89fad897", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126556, "uuid": "d024bd14-66e2-4968-80c8-4af5728f62d4", "value": "8CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126556, "uuid": "a9d9deb9-ee07-45cf-8d28-065d6511550f", "value": "3072:s2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:szxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126556, "uuid": "6cc5b8e1-d0a1-4aa6-9047-c9af6e4aa59c", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126556, "uuid": "a172c310-5ad7-42ef-87de-4b3909b70a29", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126556, "uuid": "607d8e6a-f164-4eb0-a2ef-b514a9a2a249", "value": "document-934263312.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08cd4d5-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617133243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133243, "uuid": "a64c2645-3dfc-454e-8810-6af7eb7412c7", "comment": "Malware payload", "value": "e137556fe933e55dc69765a566c84ee7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133243, "uuid": "aa0b7325-fc64-49b1-ae7e-0be94cf696c3", "comment": "Malware payload", "value": "5219b7adbbac6683157472105d93f73abf8444b7e803b690bddd6d34af31cd5b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133243, "uuid": "0afac892-6820-4c17-ae2f-24232888dbd8", "comment": "Malware payload", "value": "b36e08e5d2f812e277edf7253a3462b2aa27009b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133243, "uuid": "bb846fe3-3a36-4e7e-adb2-aa850d00b534", "comment": "Malware payload", "value": "e0d3ababe9ca0f025ce352ccde87301a37f0a2489f8b6aa68914eaffb415b18892b5b827d61fff316bae749f57995c33", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133243, "uuid": "c7604de3-9ee6-4932-9116-859cfb3f88a5", "value": "7914BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133243, "uuid": "3dc4151b-57c5-4e17-9ee5-64acab302dda", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133243, "uuid": "4907966e-0b28-46f4-8a4c-587e5b69735c", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133243, "uuid": "81e2c8e8-8963-49cd-9346-e3e30bdf43b4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133243, "uuid": "62d0c26b-af08-4cb5-97ef-9f2620aadbcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133243, "uuid": "2178e573-3464-46ab-9129-4e0d411cae61", "value": "5219b7adbbac6683157472105d93f73abf8444b7e803b690bddd6d34af31cd5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ea77ab-9145-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617101225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101225, "uuid": "d236ece6-49aa-4021-8734-5dc342bb834f", "comment": "Malware payload (GuLoader)", "value": "d3a6bd4762c0c4a6f0c0fdf2d1f47915", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101225, "uuid": "8220492b-5727-41b2-b593-9bd651784759", "comment": "Malware payload (GuLoader)", "value": "521fe877cf3543f9f967c17fa046ca186cd931624d6c5c2f61c0363b29e750e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101225, "uuid": "c6a0a1e5-15e1-473d-9ffd-50ffeca76cf9", "comment": "Malware payload (GuLoader)", "value": "2ec4b075252892291620c389c1b5803d7d89e8d6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101225, "uuid": "c45e4b31-56ad-49a3-a28e-c7e262a921fe", "comment": "Malware payload (GuLoader)", "value": "21ed2a3b3f3f75aca5d8b1d214de520301db6826d666510e74257dcc49369de5c15861df45734166df456047280ba52d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101225, "uuid": "294754df-3cba-4d5c-aa17-6f99f4ce6c9a", "value": "6DC34C01B9BCB982E53299719CB20FB6C5217D63D5231D1FA616FA0768B67C32BF0712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101225, "uuid": "c5e45138-c510-4052-95fd-46122c3a7c75", "value": "3a1dabb0c190b6a5ea3886c39f544c6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101225, "uuid": "ca1565f7-5187-4a68-9b7f-2365f661167a", "value": "768:bX71wnkVPSNDFzZJc6NYHQ9kLfynrm3E23FVp/XPa3w80KwHIKv67CE023:rikkNDdTxu69m3E2jp/XPqwIKvfE02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617101225, "uuid": "0ce0d94d-201d-44ed-920a-2661fbd7f040", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617101225, "uuid": "c363e682-e0ae-4e09-891e-0e8498885a18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101225, "uuid": "06cb5e0e-b50c-4ee8-8074-e5e338efe60a", "value": "order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966b16a6-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115536, "uuid": "b8da37f7-ef38-498e-995a-d18b7df2225b", "comment": "Malware payload (Dridex)", "value": "75c910002dce5c97b00c0eeb487093fd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115536, "uuid": "07120a8a-2d9b-49d6-a001-2063585a4f6e", "comment": "Malware payload (Dridex)", "value": "5223a8590fea36ada337c7df22653f409b3208e9e3b632baa6d0ca144f7a7564", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115536, "uuid": "75d3f7c6-69ed-40a7-9037-b962d8289af2", "comment": "Malware payload (Dridex)", "value": "07b25c8e2b3471a467321d7b1c326d9f524c1240", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115536, "uuid": "33d2c8fd-a9a0-4c24-8b3f-d8f8b7eee3d2", "comment": "Malware payload (Dridex)", "value": "bb9747cad353c39cd08e2c36352b0cdee04ad882b1e761e6cb8f715b67682e2a8bfce738e60bd26df0f17cc02a3a8b76", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115536, "uuid": "4aa1ed08-607a-4ce5-a9f7-65f5e0f748b3", "value": "3F14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115536, "uuid": "9b04aa6e-8bed-4f8d-93eb-a4696f358335", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115536, "uuid": "9c938e7d-b41a-4322-8d3e-fe58472ecc03", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115536, "uuid": "f0fa20a4-5d23-4457-8457-4078968b32d0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115536, "uuid": "ed793de0-a276-4179-9359-9e71add286e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115536, "uuid": "a3a3edd8-9d18-4ae0-a03d-14997af58d79", "value": "5223a8590fea36ada337c7df22653f409b3208e9e3b632baa6d0ca144f7a7564", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9edd051-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143915, "uuid": "79e0f942-2ceb-41e5-9cad-c1eb5376a770", "comment": "Malware payload", "value": "493ec3b8a46ca0a4444ac41806cfd246", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143915, "uuid": "e115de6e-3b84-47ff-8503-0cb3f89d416d", "comment": "Malware payload", "value": "526e00ded2c22c6978d7b819989aad487d66a67222b10e6917a402b6729518d1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143915, "uuid": "ec5a6371-68f2-4f7c-a345-cabf652f1daa", "comment": "Malware payload", "value": "d489d2a0cf60921db048614b3b3d94b530c8a11e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143915, "uuid": "a16b542a-df8a-4a4a-bfb8-43a5debab4c7", "comment": "Malware payload", "value": "9c6d3185b0a792ae7a075a134ec809b26d595b9d9429629887228dac7b373a087d3478b6bee66febee4970cfea864e5a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143915, "uuid": "02f32262-a8d6-4db8-ac8b-1e421dd4fcf3", "value": "9814BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143915, "uuid": "dfad5464-d1c7-4c61-8041-012ab46508e8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143915, "uuid": "0d94e67b-b31a-448f-830b-df1d89be520a", "value": "3072:E3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:gJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143915, "uuid": "fe1df83e-3a26-4685-a852-567f84d3779a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143915, "uuid": "743cdcb0-68fc-42b5-b979-f779ba261a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143915, "uuid": "11c3fd46-b3cb-435e-b6e1-458c2847a546", "value": "526e00ded2c22c6978d7b819989aad487d66a67222b10e6917a402b6729518d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3ff543-91b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617147464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147464, "uuid": "8a4bd4cd-2aeb-4a45-a73d-3f603e7e033d", "comment": "Malware payload", "value": "2c6cdaab9af3e656a73f4bf6a7c89f95", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147464, "uuid": "45957a85-c2d0-45cc-9179-bd75e089009c", "comment": "Malware payload", "value": "52e45af63ed1d8dffbef493db8444de3682c2fe5955fc92d49a2267419d456f0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147464, "uuid": "d937ad2e-29af-4a7e-b353-7157ac280f28", "comment": "Malware payload", "value": "4cbece3a8c4c7bffc663e1a20a0918284b67a3eb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147464, "uuid": "345913cc-bb2c-4d6b-b855-db16e5e9aad8", "comment": "Malware payload", "value": "c45a861daeffd9815e6306ec92cc53d2b55f719791198fafa9cafc3315fdc36617495f71041d775cf74a7d58998a3489", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147464, "uuid": "556f86ed-72ec-46e8-9fd9-3ed26dfb876a", "value": "1714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147464, "uuid": "4bf6ca97-3ffd-45a0-85a8-467119b587bf", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147464, "uuid": "d87c12ce-361d-45fc-a233-638650687dde", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617147464, "uuid": "98689fba-e9a0-47a3-80d6-21922daab64f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617147464, "uuid": "59978934-aa10-461c-a8f3-234684320743", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147464, "uuid": "2938f248-1301-45c5-9a45-159ef3acd9a0", "value": "52e45af63ed1d8dffbef493db8444de3682c2fe5955fc92d49a2267419d456f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe962df7-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121294, "uuid": "2c6f916f-d5a3-450a-afaf-2d67347f29d7", "comment": "Malware payload (IcedID)", "value": "5e493d80d45a9a0bc2fd82cb703b619c", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121294, "uuid": "359b4619-b0fe-4290-aea2-42ec362f42f1", "comment": "Malware payload (IcedID)", "value": "53d3d2609a6c731aa14551f427f059b50b4279c6658b423a1506b4ad613d806f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121294, "uuid": "c319bd93-b89e-4d64-8801-07b280cb4295", "comment": "Malware payload (IcedID)", "value": "2a88deb79eb2ca02fb16c57eddb59fcff0d7ddec", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121294, "uuid": "4326f508-57da-47e4-a923-41c67ce2f242", "comment": "Malware payload (IcedID)", "value": "3b46eacf660cf1dc749f7240370196b01052c5163062bde52c46b05c398b97adfdaf40bb3b462946a8995701aab4e24a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121294, "uuid": "e02301eb-2930-4913-bc9f-4c811dba0fad", "value": "27B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121294, "uuid": "6c82890d-24f2-41a4-a057-00d5b1bc333c", "value": "3072:42CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:4zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121294, "uuid": "9c3df445-a851-4976-a106-e0a191a5ddb9", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121294, "uuid": "41b1d4d3-6557-4945-81a6-c5fbb49b243b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121294, "uuid": "7acb2749-b8f4-40ca-8a83-4c3ad577ea3f", "value": "document-93110926.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9ad356-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122178, "uuid": "4ca1dc48-2391-474e-b861-62cf892ed731", "comment": "Malware payload (IcedID)", "value": "efef4fad03168995d932a8237540c4cf", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122178, "uuid": "1dcdc088-0136-45b2-94fd-02c277995cd3", "comment": "Malware payload (IcedID)", "value": "547213b3ca5e99b01b996ef9257bf46767a7350138695f766e698ea8b43a41f6", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122178, "uuid": "e13ae12b-b8a4-4432-9c2c-07be0123fbdc", "comment": "Malware payload (IcedID)", "value": "49cc89fa222768297d3d9291332ad53983635d1b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122178, "uuid": "42482fe9-924e-43de-9aad-7a505c34283e", "comment": "Malware payload (IcedID)", "value": "e9633962e2d272cd438a1b13328c0ae07527cb2cd3c5ad4b147cbb440f8a81b899bd0f30087d91a3cbd74d7b387816ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122178, "uuid": "c0a3bf07-aa70-4aef-ba87-4c97944b4f4c", "value": "EAB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122178, "uuid": "423fbda9-fc0d-4993-99aa-ae47bd886b84", "value": "3072:Y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:YzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122178, "uuid": "dc59a740-30cb-402d-92ac-fd91a45e2089", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122178, "uuid": "c344cef2-c837-421d-a21f-89a3edf62d5f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122178, "uuid": "38db34fd-49ad-4a63-95f3-4d769f76796e", "value": "document-340903746.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491cfa12-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114976, "uuid": "1c77c954-1d9d-4e3c-a9aa-f65f17464d5c", "comment": "Malware payload (Dridex)", "value": "201f6caa9523d2d701614e490ebd831f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114976, "uuid": "2fbf426c-e7bf-49c2-8bc9-b258cb020087", "comment": "Malware payload (Dridex)", "value": "54ea5c486b869f5c2cea4b7133fed9b9ead73252b763ca179d047f99a74dea7e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114976, "uuid": "0e1b2134-d2cb-49a7-a3c9-7be6f6af8e90", "comment": "Malware payload (Dridex)", "value": "9e9022b2fffb4a1d529c81d57ca8b3f994b889a0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114976, "uuid": "05e03665-b902-40c2-ab9a-c0e45d6f96cd", "comment": "Malware payload (Dridex)", "value": "6737adca1df4614cb5ad0969674325e47737332a472af52c4fddfb14b3b9930a4f05ce2c26ac867d35c96324f2090ba6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114976, "uuid": "c098cffb-7f93-4b8a-9e0b-79bb2e665e4b", "value": "7A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114976, "uuid": "1a291a58-dab8-4333-8d10-88587d8b22c6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114976, "uuid": "e36c2872-0558-40ad-9434-ecb565d79e58", "value": "3072:n3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:/Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114976, "uuid": "94a85d3d-2f04-4fe6-a2bd-da9cd95df2e1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114976, "uuid": "ff8313f8-eac8-4283-b969-e81df788d62d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114976, "uuid": "f68222c2-c7c7-48fd-95de-b67149af6b27", "value": "54ea5c486b869f5c2cea4b7133fed9b9ead73252b763ca179d047f99a74dea7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4168eae-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115666, "uuid": "78e5cc3f-06e1-4f7e-9ad2-a7dcf2e01253", "comment": "Malware payload (Dridex)", "value": "2d00b8a6d27a37219c324765109841fb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115666, "uuid": "a18b8f0e-bd7d-4c2f-949c-babcff472034", "comment": "Malware payload (Dridex)", "value": "55034ad446f4ad087275ebb2060b422a082ece262792c2139f3ec9afe5f347ba", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115666, "uuid": "731ced98-9744-4752-87fd-ff98425df25d", "comment": "Malware payload (Dridex)", "value": "e41f9113cea71182aff088713c26b717740b205d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115666, "uuid": "fabc847e-5642-4352-b9ad-6b5100d7270d", "comment": "Malware payload (Dridex)", "value": "509ff7cde50828fd511f0755526f6ed05d008b03c3abdac86d8f3f20e6c67bd6f0b2f1d92a56dece05009f8f1de26649", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115666, "uuid": "72e6cdc3-dcf7-43b2-ab3c-2d26113fa9bc", "value": "3714BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115666, "uuid": "b5c00a93-74c4-4d26-a421-340213b7758d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115666, "uuid": "39bc653f-a360-4124-9ea9-da2ead92ecc1", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115666, "uuid": "7ca6f565-5d83-432e-96d0-0b4af35cbd1c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115666, "uuid": "afa5995e-e4d9-442a-ab4e-56db35a9f467", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115666, "uuid": "14db93a8-1b1d-4900-8370-9278a8f2098c", "value": "55034ad446f4ad087275ebb2060b422a082ece262792c2139f3ec9afe5f347ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22c53517-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617120066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120066, "uuid": "3e610c36-ee33-4900-b981-1cdc5cebf4fa", "comment": "Malware payload (Loki)", "value": "30948054126edb727b936b74156154a4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120066, "uuid": "96800505-c258-401b-836f-ced4616b0e5d", "comment": "Malware payload (Loki)", "value": "550d2da381ccc752d75f776bf9371683b39e1e45e0532daf779bbdc2a060fe17", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120066, "uuid": "24e4c898-0f8e-4ccd-b942-179e2eaa47a0", "comment": "Malware payload (Loki)", "value": "36028a9b348f9ce1ceb0e4cf94b26fd9b7290390", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120066, "uuid": "9477b80d-fb69-40c3-9cd8-c98db23f1e60", "comment": "Malware payload (Loki)", "value": "0a9e8945a00004989e5e0ec1249a78aeb2f25a24180b22e27c8a532ef6bc2c8124d0799b8e7d90cfc31746241c7d0f57", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120066, "uuid": "fb89aac4-0d4e-44c7-9f6e-ac71e6876bd4", "value": "4583256034F6857DE4DE0C788301FE78176E2059C65DEFAD0568F0E635DA808AF9AE39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120066, "uuid": "3406ce3a-4759-4508-b248-7773adfcab32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120066, "uuid": "a0db7a41-a2d7-4551-944d-c712c5611806", "value": "768:+YqntMbrK73ZQsxZQs+ZQs+ZQs6ZQs1ZQsMZQslZQscZQsTZQsTZQsFZQsOZQsPF:+YqnCqs6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120066, "uuid": "f718ee15-e5d2-47f7-b811-f7d4b189066d", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120066, "uuid": "7e6322f9-3992-491b-8be2-93ba40e4ed03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120066, "uuid": "e28325d9-72f8-4087-9e3e-cb5d3a60db32", "value": "SecuriteInfo.com.Trojan.DownLoader38.17696.15423.3403", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0875529f-91af-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617146651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146651, "uuid": "1318c255-6e04-4a24-89e8-761607175fd8", "comment": "Malware payload", "value": "9e12c822848a7001046c70eeeb7c45b6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146651, "uuid": "b8da4774-26b0-409b-bef5-8d5bf4cf3ce3", "comment": "Malware payload", "value": "5516260399d09d63094ad00feb2938e7e09a331c111b24c8ae403a1f582307b9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146651, "uuid": "c4449242-dfb8-4b13-aba4-734717a10c69", "comment": "Malware payload", "value": "083d0b2ae1971061603505af605ee8d6257be4fb", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146651, "uuid": "02b3e8b7-89f8-42be-9f1b-69ba4fa56a72", "comment": "Malware payload", "value": "d318062d9702f6d688a642fb89a0d5c675f0f5caf55a24390d66ebe6eaabba59a116ddea1b6129429ee983d2b1c2bb68", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146651, "uuid": "d958b502-1ce1-4215-8958-bf670dbb91e6", "value": "5414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146651, "uuid": "11a9f739-9b09-4676-9ccd-958346d0ab83", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146651, "uuid": "1bc69ec9-e2ec-4541-8c0c-96b83486bd06", "value": "3072:p3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:BJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617146651, "uuid": "a14007ef-8dd4-4c96-ae25-e085d70b1d8d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617146651, "uuid": "35b7fb3f-d6b7-4745-b046-9b9241bb357c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146651, "uuid": "2da1bf30-7ecf-4749-810b-58559620093b", "value": "5516260399d09d63094ad00feb2938e7e09a331c111b24c8ae403a1f582307b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c13d7b2-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106767, "uuid": "ec6bafb0-2cdb-4c65-9459-0f74050a91d5", "comment": "Malware payload (Formbook)", "value": "2ef2e7e7045a74037c6d82f9d0a6da8a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106767, "uuid": "8bc7ab86-cb5b-4a99-906e-6fc2b7cd7a48", "comment": "Malware payload (Formbook)", "value": "552b758e460fe458ffee36c59aea204b0e4c5f0773d1c41c0b7f88afe3fa3cf9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106767, "uuid": "bd488295-544b-40f4-b04e-ad67cebae885", "comment": "Malware payload (Formbook)", "value": "4afe348a4fc5b647d904701616d9357a9a8d30d3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106767, "uuid": "0410cbff-c454-43da-95f5-a53986a800ee", "comment": "Malware payload (Formbook)", "value": "f719c547cf6ee3dae3c07713ebdb140e21f6d4040c86ea3900016d6c2aadc679110338ffbdb211a43db4210423eb1254", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106767, "uuid": "c205b823-f423-473e-abea-d4f6854593ab", "value": "D38423CECB526D29134BF697E7D08616CAD0E48DEC581B6C86EC33F90E992C47697940", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106767, "uuid": "d8fd01c0-e8a2-45cd-a1bb-73ae0937c274", "value": "6144:AlJVFKgsXK8pIKAlPAZOsvtq97WTmBJvezUwkpan9KQ/Gv0uzRRDk4nG0et40:IJKgsXKqAhqnUN8QwkpuKcGsEHkOGB40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106767, "uuid": "52a0dad2-c79c-487d-8b32-793231c4bc5e", "value": 377230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106767, "uuid": "74da7f99-1991-4970-bc8a-a18cbbda55b8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106767, "uuid": "0489e3bf-30c2-4caf-8e20-4ee55295df21", "value": "PO_RFQ007899_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b072824-9195-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135595, "uuid": "47fc3c57-a7a3-4300-840a-506fead54cf6", "comment": "Malware payload", "value": "313ec98d99f6b49be48196342a91c2ff", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135595, "uuid": "00dff91c-c9f9-4616-99c6-6e11facffcd5", "comment": "Malware payload", "value": "554a1a5fd210cd2e1382f5cd17c11dbcfc3326485817651b51796ee77297aa9f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135595, "uuid": "d3dcd681-ff6e-4828-a9f0-7daacc263c86", "comment": "Malware payload", "value": "f5d6c5c27033af77a6668e0148e19cc69a299de8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135595, "uuid": "2471e8a9-1331-4c5c-acea-7e1eeb8a1bc6", "comment": "Malware payload", "value": "9cf675b4b0e079ff7581ebec84239db8805e31c8c36f1c4b6ea0681c37864b6c69e91f1be1c270be763a048f4d574ad6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135595, "uuid": "509e99ba-491f-4aa9-9531-8605fa3d3547", "value": "1C14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135595, "uuid": "73ff41a2-ddef-497c-b8e0-8b354c2c27aa", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135595, "uuid": "2e880bac-1635-4163-89b6-4dd3d62b9b0c", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135595, "uuid": "05750b38-640e-421d-a4cd-370e7e6efdb2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135595, "uuid": "ef851322-6651-4664-8a27-88c5b16d0531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135595, "uuid": "73c2e822-5f1f-4da8-8c2c-d33a085fe12b", "value": "554a1a5fd210cd2e1382f5cd17c11dbcfc3326485817651b51796ee77297aa9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002037bb-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114424, "uuid": "cd91c338-3760-474c-9b1c-f97332fb58aa", "comment": "Malware payload (Dridex)", "value": "a55453128d762ce61a5b26277b9d0160", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114424, "uuid": "a4193f42-6c49-4c54-9bc5-85310d45abcf", "comment": "Malware payload (Dridex)", "value": "556200c36e99753d77bf3d770d7d9c4005a28a19f26f2c2beccfb6049c0d0898", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114424, "uuid": "a0888a6d-0f1b-4258-9f8d-0c23b5980cbc", "comment": "Malware payload (Dridex)", "value": "80b9114a65afe2f2a06e0aab081696aaaadaa420", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114424, "uuid": "7b64cc08-f3a6-4ad5-bbfc-19f6f2e7e011", "comment": "Malware payload (Dridex)", "value": "5e8de6f08c15b1efeb20ef3715b05337220afb211a100060d4b26e389acc5fbd738005e994b57f3f97ebcbb347be8b97", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114424, "uuid": "b5345d4f-505c-4766-97bf-40f69a3edc6c", "value": "C214BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114424, "uuid": "e28a43b9-6070-4702-81a9-d8c3f991fce3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114424, "uuid": "eddfa12b-53ae-47e8-bb05-2cb401cfa8bb", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114424, "uuid": "b08310f1-aa4c-42af-b3ba-314169cd1b12", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114424, "uuid": "55a93f84-2591-4be0-bb6d-57fd75b1418a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114424, "uuid": "9c1cd3b4-be27-43d5-b6b2-29750192d0fc", "value": "556200c36e99753d77bf3d770d7d9c4005a28a19f26f2c2beccfb6049c0d0898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3971d81-9185-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617128926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128926, "uuid": "025b74c2-29ed-40de-812a-d371b2f2be24", "comment": "Malware payload (NanoCore)", "value": "2416d368ab0c8c145e1ecbc5d9666aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128926, "uuid": "f2f1e4da-d3a2-41ed-a5e8-635dcb4e86e6", "comment": "Malware payload (NanoCore)", "value": "557848d9b6d6964fb3a1fc44279c7b9e728d48b659f73c2d3aed2953d083e8c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128926, "uuid": "0982b61f-852a-4682-b64d-d9ca6553ab61", "comment": "Malware payload (NanoCore)", "value": "a976edb80866f4a7a3024aecce413a6740bc9448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128926, "uuid": "38a305f6-1327-4fe2-b11e-a7dab2911847", "comment": "Malware payload (NanoCore)", "value": "0969cb414ae7d5acda89b3f8db9696761041947b4124a0b6dc069965ab49d48a0752ce789e6eea92553ff43a02d72732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128926, "uuid": "2d35413c-fd77-45e5-a19c-4fde6dad0270", "value": "E124CF1A37A94A2FE2CE827975120212937DC2E3A8C3F3EE59D854B75F257E1060B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128926, "uuid": "45bb71ae-ea31-4dc1-a90f-fd92c010c21c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128926, "uuid": "18bc877f-5658-40eb-9b80-7063b9507e92", "value": "6144:yLV6Bta6dtJmakIM5j93geIiUihuoa3cJXj:yLV6BtpmkYQeItoycJXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128926, "uuid": "7a1e9c6b-c7f1-4e7e-b2b1-29ddfd5a10bd", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128926, "uuid": "6f6c3a71-62bb-4a8e-ac42-35002a264b7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128926, "uuid": "65290bb6-ecf6-4ccd-9481-652be0583143", "value": "2416D368AB0C8C145E1ECBC5D9666AA0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fab494-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114453, "uuid": "266aee60-5e52-4a7c-87d0-d03a8c0ba977", "comment": "Malware payload (Dridex)", "value": "2852914a3fbf85eb4afb8451cb9f5eb3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114453, "uuid": "21794911-3a0f-4e5e-b0e4-8ac924102132", "comment": "Malware payload (Dridex)", "value": "5591ef8d0492f45eb4fd0bb8500be29ebcd5d5f04541bfcc46d63e8f67739405", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114453, "uuid": "3d793223-7f88-4da2-b2b9-d398bb610853", "comment": "Malware payload (Dridex)", "value": "0ca8a9a2ec4374e708bd778751d9111ed9536bb1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114453, "uuid": "52d7ab48-e7b2-48cf-8e8b-c922ef0463e9", "comment": "Malware payload (Dridex)", "value": "bdc7d9e2b758cbfa1aca84fdda17435596623fd859df1372cb740e54a3bac1e23ab0eac562ad5034cf25b4a74b4e3fe5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114453, "uuid": "26e8b19d-7e33-49c3-a3b0-3ae9c09503d9", "value": "4114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114453, "uuid": "fdd170b9-1eb7-4b55-aa75-fa4cb3eb5ead", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114453, "uuid": "1ebc5587-76fd-4daf-a028-93ab6c189e1d", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114453, "uuid": "7c456602-459f-485b-a0ab-6fd1edbb647b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114453, "uuid": "32533350-d91a-4c1e-b7ba-7c8effa2c1ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114453, "uuid": "b4d258bd-52e1-4aa0-a3b9-cd60737b15a4", "value": "5591ef8d0492f45eb4fd0bb8500be29ebcd5d5f04541bfcc46d63e8f67739405", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2854495d-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115351, "uuid": "da29a4fb-47e3-4a22-954a-b8e1c87cb51d", "comment": "Malware payload (Dridex)", "value": "e8f4e5f2b28875d36ca72b6e79205e91", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115351, "uuid": "b5908dda-cf31-4202-9acb-67407e9d45ec", "comment": "Malware payload (Dridex)", "value": "55fcd38fc80caafafb40c51c037d30c81f629ce124ec2a38a1d61ca86bf946ca", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115351, "uuid": "dad08d7a-fb87-48f2-abd4-b3ad83b2225c", "comment": "Malware payload (Dridex)", "value": "5e930cbe408e9bf402b33bc730c44ddaefa7bd76", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115351, "uuid": "65c5b723-fce7-4e52-af25-28c35575f21b", "comment": "Malware payload (Dridex)", "value": "51c60cff5862799ad4958adb374cd329b1bb9113c58c34c5e1a40e32b31c6f8153c47e15715dfb4573bc15bd4e6bdadc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115351, "uuid": "1505eb71-3a24-469d-b206-9bb994c6dadd", "value": "F114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115351, "uuid": "33c916d5-3b76-46f6-abd7-24a6707f7d2a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115351, "uuid": "fbe4e28f-5451-417e-a328-e8da27e66ae7", "value": "3072:H3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:fJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115351, "uuid": "6b4f16e3-dc20-482d-afa8-a182e83d75ab", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115351, "uuid": "133e91fc-3e7e-4236-bfce-517fdcede825", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115351, "uuid": "5b171f08-99cc-49d9-b2fc-69c3201ff752", "value": "55fcd38fc80caafafb40c51c037d30c81f629ce124ec2a38a1d61ca86bf946ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e8a357d-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136890, "uuid": "a4c94031-34d0-4884-9e3d-1cd2135b5eb6", "comment": "Malware payload", "value": "e3e13d3ed26a756f6e72b077a79e88b9", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136890, "uuid": "ed056b03-63a9-4673-8f35-1927005e0f6f", "comment": "Malware payload", "value": "55fe37842b513481201992a7243ce90892055bc5f2970b544e24fcf7a0a93e9b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136890, "uuid": "2a920385-4bb6-4069-84f7-674c0263e2f3", "comment": "Malware payload", "value": "677cbc9aa0a5170d47415d9010f6ee1a0bade863", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136890, "uuid": "4921e823-73b5-4faa-8d17-9aa19e931376", "comment": "Malware payload", "value": "9971cd6562953a987a1380bc23b116fc04b79adf7d972dc3343958b96543cf606bcf55bdec269acd23e5c7ee3bedb52f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136890, "uuid": "8a505d3b-c056-49ea-8970-cc029128a229", "value": "1314BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136890, "uuid": "0505418c-0752-4387-b0b7-7dc37dbf65a1", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136890, "uuid": "1ca064ea-73c5-4201-8172-a0026bc9a2e3", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136890, "uuid": "f63d3d61-3b3a-48a4-b3b5-6b14848e1bea", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136890, "uuid": "dbab8aef-79d3-4915-b19b-51fcb3cb63a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136890, "uuid": "e1b24bf3-c787-4218-9833-6895f2ba6a56", "value": "55fe37842b513481201992a7243ce90892055bc5f2970b544e24fcf7a0a93e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02f22bb-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120706, "uuid": "12790668-d016-46c3-ac61-f1998a177cff", "comment": "Malware payload (IcedID)", "value": "527fa4d27f70c44895aa4452a5123922", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120706, "uuid": "2a44abac-7d82-4f10-98ec-f2ea3e93b314", "comment": "Malware payload (IcedID)", "value": "5615b1a423ce697d57c359413cfb9c0810b000f4a0594f6ae3dd5505ecd8ad23", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120706, "uuid": "dc5697d4-2093-4937-8972-27c3e255fa7d", "comment": "Malware payload (IcedID)", "value": "800b08b65c113608db35176b4528bdc39917a2bc", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120706, "uuid": "e5a62e1b-39f4-4ea7-aef3-3d5fec4281e9", "comment": "Malware payload (IcedID)", "value": "d2d3a5409c41f991fd338888c7c78a8278fae240797f834e7aec7381b7ac18552b9cd34168b32b259a5f0aae981fabb6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120706, "uuid": "959ec8e5-94d3-42ae-a774-f76ff55f3a90", "value": "F7B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120706, "uuid": "5603abe0-a35a-4b86-88d5-424d97bc9b11", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120706, "uuid": "2c6e5fa3-9499-497b-9d88-ca826f55ccd6", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120706, "uuid": "9247479c-2925-40f5-a71c-0135e0a01ef9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120706, "uuid": "5df31b05-492c-4531-89cf-27343e53f77e", "value": "document-718178592.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac7273e-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108564, "uuid": "fa5f6a2d-1a79-480d-9e7f-a3653a1dd7ea", "comment": "Malware payload (Quakbot)", "value": "1202475c36846f47de00c0e6642bd7b9", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108564, "uuid": "16e54ce4-02a7-42a2-b7a0-c7362fdbe484", "comment": "Malware payload (Quakbot)", "value": "561dcdf3a6586031e1e00f0276fca6bf33f01f09603589c25f9bb205e26dc62d", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108564, "uuid": "fa88d430-3ae5-408f-86e4-541233766424", "comment": "Malware payload (Quakbot)", "value": "b6058b81cd9ae5a98cf78c797aff5a9f7ce7f066", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108564, "uuid": "6b11d0b6-85ee-4377-8e9b-ac970b16aeca", "comment": "Malware payload (Quakbot)", "value": "1cee5222b9996d777788a70a19e519992fbd5750c378943e9aa2776f48b7c9ec5790e75770212ad5e5262f17a8b50941", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108564, "uuid": "a15d896e-6614-490c-a6f2-7bcb35e9695a", "value": "BAC3CF5EA350B5AEC36FB53D5646A8E31C470052A586B12F35B0BF0DA4EA2C71F9F09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108564, "uuid": "f148b145-6ad5-40fb-a9e8-246afd783159", "value": "1536:A0vkkYfDvNETv7xVMsigZEQNggMorCKL6mTpaDw2WXt/+nQXaN6bN:A0vkFfDvCTdV/vEQSlcCyEDQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108564, "uuid": "d83ca11c-3c60-4067-b8d3-1e203a8be1a2", "value": 120498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108564, "uuid": "f0323f06-ab04-462d-9dc9-56e01fb46d18", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108564, "uuid": "18b58912-3e7d-4da6-bf86-49cfdf1f1156", "value": "impr_2679.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a485bc51-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120713, "uuid": "b2185a9b-38fa-4334-8eb0-3910e97df38e", "comment": "Malware payload (IcedID)", "value": "424b5a23c3cadc04d7e8b99438721be1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120713, "uuid": "fa7472ef-91bb-48ff-ae2b-4c901ff87b17", "comment": "Malware payload (IcedID)", "value": "56a48447a0e8f841f188f8f3ab6e88d1669937834249be56b078378e89e03fc2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120713, "uuid": "38e464ca-88c2-4436-9b4e-b10538c4d27a", "comment": "Malware payload (IcedID)", "value": "34ce17ec097faa4c0565eab32d9c0a251d02f1c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120713, "uuid": "01b74173-0bdc-4eb3-87fc-d7bc01f0fb50", "comment": "Malware payload (IcedID)", "value": "d8bc3434d6ccd444dbd25ea980cf79345531aa1b6ebe0b3d42dc9419a48a8a5dbc3b5df733be293122f6c1ca3c442684", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120713, "uuid": "bbb4c405-21ac-4028-99ff-ee19763bf43f", "value": "4F135DCA05700B22D5365672C5B31B28C27BFB40B7D368FBD19C7698C5C2180D772DAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120713, "uuid": "f7d022de-e2c0-4ebf-bf75-1b9ebab1a9fc", "value": "768:RHppffnqCuZgKEq2OqmBhw9+eyA/Dj74zZ/mgxH7Wgagg1nXFJBMq/umJUZp:NDqvHEbsBneyAbniZPWznfBL/nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120713, "uuid": "80e19536-01ab-4111-9b13-f5fa6b6d38e7", "value": 44565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120713, "uuid": "e2410e67-cacb-48ef-88ff-4c6cf6385e29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120713, "uuid": "a2a3e83c-4ab3-4b72-abca-6aa8209877e2", "value": "424b5a23c3cadc04d7e8b99438721be1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ed0ba56-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617088491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088491, "uuid": "cb86af59-607c-4bfc-b061-5067cd8c339b", "comment": "Malware payload (Dridex)", "value": "3479d48fef3fa742d91e84705ff4f882", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088491, "uuid": "ca5e91fe-1557-4094-898d-db6b94053753", "comment": "Malware payload (Dridex)", "value": "56cd0bb2fb78736e872dbb88fd9cdd78435b13e15c9b0be2b6ca709df36e93b1", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088491, "uuid": "a5285552-1b10-4b0d-ac22-3b469ed596b9", "comment": "Malware payload (Dridex)", "value": "e9690178e10048937417194a9dfb88c7bb22aef4", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088491, "uuid": "18fb7321-e410-40cd-8325-68c5b6021e82", "comment": "Malware payload (Dridex)", "value": "7a655afead023f2ff41d4fb39464001dd65d112aa07841b6d9d977b565d82b5713696d1152fe78e2061f3c2318114561", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088491, "uuid": "61450f52-acae-49d8-9c68-35eae58fb977", "value": "B4C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088491, "uuid": "5d8e5789-e825-4c8c-b2d4-fe435f826a65", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088491, "uuid": "daf24c46-6c95-4a3d-a4a2-755d806f1837", "value": "6144:sGiMOQpsduhD3AZHC/uNbExd+4cuwL1b0717WLmw6Xg6DqaIDnnlvghJ5la:RVhDQZHC/uNYe/LRm8LYQOQlYll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088491, "uuid": "e796f412-18e3-400c-a027-fd5395832ab0", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088491, "uuid": "859aef8f-9a25-4ce7-a9a4-477e8eba94ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088491, "uuid": "bca4be7e-9e92-476e-b47c-4967c72d1c0b", "value": "56cd0bb2fb78736e872dbb88fd9cdd78435b13e15c9b0be2b6ca709df36e93b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313b7563-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "a1d0f7f1-887f-47e5-90b6-c011b618ebf6", "comment": "Malware payload (Dridex)", "value": "0b93ad27449b73a6b8d4f1a089f0c7ac", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "73ed3870-4edf-44b3-ae06-7c94bbbed8e9", "comment": "Malware payload (Dridex)", "value": "56f631370201e44f1b1f528dbd6cbc644afd74d1deabc2e482b6d8c3bd17b464", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "24bd91a3-8004-4764-90ce-abfc8c4c0be7", "comment": "Malware payload (Dridex)", "value": "064403c792aa4be0a416d38bbe5bc6e83ca3e8b3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114077, "uuid": "e4638569-cbcc-4248-99cc-7870a4610c9a", "comment": "Malware payload (Dridex)", "value": "b2e136117ebe55cd3a7e6da886b252d2d1a1228ef52ff145fba7b72f82acd384187a6655e6d88ecc918b2d8f084db7d0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "b88bca6b-a01e-4b8d-9022-dbfd558ac391", "value": "0114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "4057bc94-42a2-4474-860f-6c44f0607775", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "1a09a0be-368d-4231-ae6b-277766cbafed", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114077, "uuid": "6c07a418-1f59-4514-a956-e8f0e36747d1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114077, "uuid": "8954c6a9-f320-434c-aed1-1f770dd78831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114077, "uuid": "c1639d35-18f2-464f-99c3-b4e3391ab6bf", "value": "56f631370201e44f1b1f528dbd6cbc644afd74d1deabc2e482b6d8c3bd17b464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c87980-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120640, "uuid": "e5542273-acca-4f67-aa78-47a7d8841c89", "comment": "Malware payload (Dridex)", "value": "a6ecb3576f4cd22273d91967ea30e543", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120640, "uuid": "8ee4836b-4162-4be8-b3f2-2c85dee21f57", "comment": "Malware payload (Dridex)", "value": "5701b26bbd99706212a7c61adc69b39f1e76912b85cd9e4ac24fc867b1576429", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120640, "uuid": "56b17a1c-e785-42ea-8be1-dd13bbf5cb7b", "comment": "Malware payload (Dridex)", "value": "d801c6b014db184df2422f591d120adf178a69bd", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120640, "uuid": "8bf77a30-12a0-4fc0-9e5c-255d38542c60", "comment": "Malware payload (Dridex)", "value": "a6a278f3e882f0d06a0e5fe4521c8872e42f29b2e07f42e45ccfd773680966de69d2b419e393d69619844a8e00913e55", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120640, "uuid": "bcab22fa-d0b7-495f-a27f-7756b6c40f50", "value": "F714BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120640, "uuid": "1f2d9af8-bd4e-43f4-a7f7-eeb415d455d5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120640, "uuid": "893885f1-3331-48c3-ab67-a32096d7d501", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120640, "uuid": "e450fe44-9afa-43b9-bc12-9d19db62ae73", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120640, "uuid": "89f88583-69bb-463f-84ae-7fbd1183473f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120640, "uuid": "e02feae9-a15b-4cdd-8be9-38cedf2f5676", "value": "5701b26bbd99706212a7c61adc69b39f1e76912b85cd9e4ac24fc867b1576429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc685792-9146-11eb-abe1-42010a9c0039", "comment": "Malware payload (ZLoader)", "timestamp": 1617101882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101882, "uuid": "1d7cae33-47b2-4d77-832a-d368581cd87a", "comment": "Malware payload (ZLoader)", "value": "6cdcdd2a2211570c00b3239ae350ee4c", "object_relation": "md5", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101882, "uuid": "09bb60ba-ec30-4ae3-bc2e-eeb25f5f470b", "comment": "Malware payload (ZLoader)", "value": "574ab0eb02d9059cd771a6af0c467dfa1ac487baf10c54723e6b04771aa48059", "object_relation": "sha256", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101882, "uuid": "de911119-eb9d-41d3-a4ed-50db1c4d1201", "comment": "Malware payload (ZLoader)", "value": "edfdc0cd64af23cc2a5ba21e00410d9451d0871a", "object_relation": "sha1", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101882, "uuid": "53875f71-7717-452f-aca8-9c33e004cb3a", "comment": "Malware payload (ZLoader)", "value": "408fb35b923c26a061226db8f9da48d781158ee7929437d2f4e82107033f789c171d3ace6cff9a425669ce8408f4b9aa", "object_relation": "sha3-384", "Tag": [ { "name": "SpelevoEK", "colour": "#6B768D", "exportable": true, "hide_tag": false }, { "name": "ZLoader", "colour": "#95DA90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101882, "uuid": "9e250f51-454f-44c4-843d-bdb91eed95f7", "value": "A9A42934BC8F817ACAFA68BBC09C86AE651899184FD1A1D312B273C6587D7C3527C1DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101882, "uuid": "32b548e3-d24c-4085-b449-70b159b13a44", "value": "130d08b7b4010d71446ab8143dd3c3c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101882, "uuid": "1c7dfb8e-955c-4ce2-8641-f85c41865c2a", "value": "6144:BaovaTaXGPbnZcTWcqcJzC3CilHU4XP3SKAFTCgdVbRRrwdZ9a:BaogaXGPDGfqc5eU4/i7lPXcvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617101882, "uuid": "2f3bab7f-da7f-484b-8800-1ad793bf8705", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617101882, "uuid": "301042bb-b918-4004-a17f-675d78f10814", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101882, "uuid": "a98dcb8f-38cc-48d3-9716-936a8dd6c281", "value": "1960546.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91658980-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114239, "uuid": "84c16bc6-a8a2-4d1e-a8ba-11b48ea7b5ca", "comment": "Malware payload (Dridex)", "value": "259d3eab9a0f32112be941e2c842fc24", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114239, "uuid": "e8352ec3-c71d-41f4-8a25-eb80c0f21d11", "comment": "Malware payload (Dridex)", "value": "576dbe8a2c6edd25e03c5bb575714a5b28a9952283fcf2bcc65af5548480546d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114239, "uuid": "4fbe4e55-e3c0-4676-a96c-6b7c305b54f5", "comment": "Malware payload (Dridex)", "value": "390d1918f1f67397ccf2b34d71c2ae3aaf493116", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114239, "uuid": "c28c085e-1618-4f19-ad70-dc4c4d1d5074", "comment": "Malware payload (Dridex)", "value": "571defc2ac9b289e51996c6e0dc6c27a8fd6abf93223354a9153cd260c8769feb88a5de5cc0b84a2320f7d4193e40f63", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114239, "uuid": "7b51e1f1-bf3b-4d2d-bc6d-b8e7d4a5f7f1", "value": "5A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114239, "uuid": "1d7cbdeb-4ba2-463a-a778-ec962eea2f3a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114239, "uuid": "fffeaf51-4962-4afb-b3ae-bc463139f251", "value": "3072:g/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:g3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114239, "uuid": "c3794003-7436-4f76-ba21-ebec4bfd0671", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114239, "uuid": "c30bd091-82f9-4103-9c38-4f025d405498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114239, "uuid": "46cd31a5-4eb8-4205-8b59-b3f1f6abe89c", "value": "576dbe8a2c6edd25e03c5bb575714a5b28a9952283fcf2bcc65af5548480546d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d576213-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122231, "uuid": "8b26c731-18f4-49c6-8209-ad9cb270fe1c", "comment": "Malware payload (Dridex)", "value": "45662e9a0b23b5c04d1c38eeb18ab5b1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122231, "uuid": "d48fe061-08d5-4727-bb53-1bcc33fa74f6", "comment": "Malware payload (Dridex)", "value": "57745002e0c7d3925753147dcfcc5c9d3fa34c00b1ef169b5212393f9213d1f3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122231, "uuid": "2066fa7a-0070-4c12-89f3-9882a201cf81", "comment": "Malware payload (Dridex)", "value": "60e2e52acbd887879f540a117ce6f890fee2a6bc", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122231, "uuid": "9a25a2fa-fcdf-4d37-acad-eb1c115033d1", "comment": "Malware payload (Dridex)", "value": "0c67e2cb6b44c4fae9600e785dcd9b27cf66e40980eb2e9ed1d256e616d060962772c9db5858131e4cdd52ee64a2a690", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122231, "uuid": "a3c5628a-44fc-4cc8-849a-f944bcd57e59", "value": "DC14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122231, "uuid": "0f1f5454-0ae3-40e3-bdf0-28c66b957e10", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122231, "uuid": "0f501a99-3b80-408f-aa98-2be385b872fb", "value": "3072:F3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:FJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122231, "uuid": "4877582a-2dff-410d-bbd1-69a17ba6c8d3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122231, "uuid": "06e90581-ef43-412b-8766-1460741fd236", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122231, "uuid": "48faf7c9-278f-4f7c-b1a1-2be09ac26f6b", "value": "57745002e0c7d3925753147dcfcc5c9d3fa34c00b1ef169b5212393f9213d1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d260ffe1-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108764, "uuid": "8e2613d4-c4e4-4e24-a9d4-d5253ad52624", "comment": "Malware payload (Quakbot)", "value": "727ffff7c47db607b006c7bf488e3285", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108764, "uuid": "ca947f1a-d856-4f5f-a1b6-f9f39f195e6f", "comment": "Malware payload (Quakbot)", "value": "57f8a37b6af2a1c68f212a63879226db30829bd45c11dc4ba462476f814d6975", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108764, "uuid": "7ac9dc11-86c7-41bd-a728-312e2bfd2391", "comment": "Malware payload (Quakbot)", "value": "5b321e8c576f964598e6a1b177d451d43bafd556", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108764, "uuid": "e173796f-da43-4c98-8fa1-d3019d1ee7a7", "comment": "Malware payload (Quakbot)", "value": "375fce390e22de4c728a2320e3abf6538859a2668573fde578fde0d360a2191e0c9b23970fe9addb872c9b78142e41ef", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108764, "uuid": "d06ba802-60de-425a-9018-354437c06f31", "value": "00B3BF8DB280B56EC39FB53D9A42A8D70C861092A967713F35F4BE0DA4E91C31F5E19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108764, "uuid": "5c8b0641-d819-47a6-bf3f-92118a2932fa", "value": "3072:UgIiKXXvWPMjWTdV/vEQSlcCq5wsXrIq3:UgNm/WoWRd7ucC+wsXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108764, "uuid": "cabd9bb9-0e4c-4e75-bf56-add2ed4b887f", "value": 112276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108764, "uuid": "84470560-4aa7-4681-87f5-09aa42cd19a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108764, "uuid": "be7668a4-2987-415e-9c90-9dce3cc9cf1c", "value": "lista_1823.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af00c65-9185-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617128616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128616, "uuid": "99d64ec7-be24-4ce6-baa8-5bc33c6d430e", "comment": "Malware payload (IcedID)", "value": "aecd81d43e441c73336528aa114b9bc2", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128616, "uuid": "82cb34d3-de53-499e-8cec-4ecb862735e3", "comment": "Malware payload (IcedID)", "value": "5800dab5100a9a0496bf4a87827a821630b6ef9ad90dc5b31f550e30ab3dae11", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128616, "uuid": "19b0e414-1805-45e7-835c-de9eee0ca9c4", "comment": "Malware payload (IcedID)", "value": "6a4731d35803a9902a2714fb3f63836954821f4a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128616, "uuid": "0434a210-093c-4e28-924b-fa9d5f16bec3", "comment": "Malware payload (IcedID)", "value": "a30454bf261c20e9a2c543dc85f0a2ba197052516fc316ec0ec2a2e96f4cc1b875ac58489a673034bae636ceb5afaa9b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128616, "uuid": "06935ecf-57e4-4b1f-8c05-e13b49929375", "value": "C1B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128616, "uuid": "7bf24981-0de6-432f-859e-95d4c179183f", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128616, "uuid": "ae7b771d-cec2-45c8-881f-22048e3e9f2e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128616, "uuid": "0cdabbe7-600d-444a-89c8-72164179377e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128616, "uuid": "4d307259-2e36-4de5-a7de-57ab1fdb7f58", "value": "document-72032780.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089e03de-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137202, "uuid": "efb654ee-a474-4d87-b59c-ccf229df6a37", "comment": "Malware payload", "value": "18ed4d5c0f8d2defa4e543444b15022e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137202, "uuid": "7bed0c75-97a5-46d3-a611-ac79379d96a7", "comment": "Malware payload", "value": "58a3874e088dc1c240d7f84bc0312f128543d363362ed17ceb24bd71a5216c34", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137202, "uuid": "dd80d341-ce92-4d04-b5e0-04c8c728def5", "comment": "Malware payload", "value": "ff858a32baf22dec54bf7ab23f2112a52e6141ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137202, "uuid": "6ea86345-c33a-4157-b879-d329c0210697", "comment": "Malware payload", "value": "8a61bd5ea891793ed4739e0ad17d9b65db6e1f65fc9c82d68866bb17abe1c78bf01b4fcaae4fe7d3585eae3febd288ff", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137202, "uuid": "2ed779d8-674b-48a1-a8c3-04852cadc57a", "value": "FE14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137202, "uuid": "f7e41ced-2f62-4562-b97a-14f0c2147d6e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137202, "uuid": "fe92f1b1-3f1b-4aec-b4f3-6001337b9a21", "value": "3072:E3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:gJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137202, "uuid": "bfe2ffe8-3362-4d81-aaf7-eba25578010a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137202, "uuid": "dbf651a6-86be-49eb-add2-1496b265424e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137202, "uuid": "2a0bfa00-0f32-4168-91d4-93d13cb1fe12", "value": "58a3874e088dc1c240d7f84bc0312f128543d363362ed17ceb24bd71a5216c34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c4fcbe-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108740, "uuid": "6deb1ab5-928a-4431-93d8-def5c4c1429a", "comment": "Malware payload (Quakbot)", "value": "9b1841478cf14f208ef7c823fa061cdf", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108740, "uuid": "d1bd23f1-f89f-494c-b04a-9a6371a1193e", "comment": "Malware payload (Quakbot)", "value": "58f040bb962ec7a88bda7d9b4f521ed9116fd4478d6fb98b5513912fadec716f", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108740, "uuid": "de26797a-cc76-4c85-9431-86906a6c2370", "comment": "Malware payload (Quakbot)", "value": "f633213296e1aef2a789fc7189c75871338c7b0e", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108740, "uuid": "0de074f7-3970-4601-b95f-dbd10c5582b5", "comment": "Malware payload (Quakbot)", "value": "d03a353de5c60c511bec12666a2ae3064bf5706da7ae20661e838151f31c9e3df5b155533ef75549d328d8b46db5711b", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108740, "uuid": "47559b0b-51ae-4e94-93c3-2b556c807e52", "value": "EDC3AF8EB240B55AC3AFB43D5642A8D31D861096E457B12F35F4BE08A9EA1C31F9F1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108740, "uuid": "889e8de2-a8bd-4be4-a45b-3c4c990f102e", "value": "1536:m2S3jdEWgW0UHTv7xVMsigZEQNggMorCKR5wohpwX+qIyHpqUH9HXhu8O:vgdhp0QTdV/vEQSlcCq5wCpwXrIz8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108740, "uuid": "3908f1c1-99e1-4547-ad2d-91d0f36e762a", "value": 124379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108740, "uuid": "de1a7e3d-7b2f-4379-8a64-a4f577519bf8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108740, "uuid": "f4b678f0-8026-40fd-b5bf-3556fb4617e8", "value": "lista_108.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "999ab2c7-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617085476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085476, "uuid": "a8bd35b2-7fe2-472b-9bec-32d2302dff06", "comment": "Malware payload (Formbook)", "value": "0a6783edefd2bdd6db218a6c1573836d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085476, "uuid": "c921c9c4-eb1b-4eca-ac06-41f7ca336cb5", "comment": "Malware payload (Formbook)", "value": "59376f91fb0637be9672bb23efc91acf2ef949826c74dfb927146f9799eecd08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085476, "uuid": "7e18a1ce-c0ae-4ade-a594-0a1b1faf7d94", "comment": "Malware payload (Formbook)", "value": "71d5e7699ac71519f95120ffc617919469858330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085476, "uuid": "3c51f33d-c002-4c2e-83b8-4131a1d4f51e", "comment": "Malware payload (Formbook)", "value": "666e237bab1060a81bfc07569f846c0146a34a66a5c8aa2d341c43509d8b8383455a302a45395bacbe974d7be9ab2759", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085476, "uuid": "c8c72072-a32e-41e7-8bcc-ae3c7020fd20", "value": "76E4BF0972F6C7F7D25B26714DA5B92491A8A5B40B2F86D3F3E24F0D99B9CC12335232", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085476, "uuid": "8506a3a1-b0fc-4e54-8d5f-aa85014c2f62", "value": "0976b68aacd405d489826ae02564833b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085476, "uuid": "656230a5-0722-4b7a-9460-0f79f29c677f", "value": "12288:s3rRQeg+Qm8gBNXPWTqsYvnKcn2z3FLMDd2/P41CzsbGIzqo+EZMk:s3CegP0PWTqsYmLMDIok4bGIpfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085476, "uuid": "5e4aa5d7-4a92-4d0a-a9c9-b57da70b34db", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085476, "uuid": "4edb35f2-fda1-4fd3-8512-fdec2cf578f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085476, "uuid": "4d345c8e-4b04-4514-ab30-02803b25da8c", "value": "Order Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db319d3-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126554, "uuid": "d48df487-0965-4763-a1da-5469005dcc60", "comment": "Malware payload (IcedID)", "value": "101c97b27359c735aba861f8c1d192e4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126554, "uuid": "55403acd-c730-4f98-847b-2efdce5298f6", "comment": "Malware payload (IcedID)", "value": "5948ecae33e93052e6e008698bab45df5b898454bef9bd06ceaf19f4bb6d4586", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126554, "uuid": "85a877b5-ff49-4367-a33a-6369522ddc78", "comment": "Malware payload (IcedID)", "value": "c9e886fd81cbb7c164d3dc3c35588f89c3e5127f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126554, "uuid": "2ba87377-1686-4e69-a663-53b975f840f1", "comment": "Malware payload (IcedID)", "value": "b2638d7647415c57721a7936c6639c5dbd406ad6e9fda2a41b60b338c1599489dd3ac357d4089f98c05e50b071ae3291", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126554, "uuid": "f835fe0b-6263-424c-b131-25cc31c4f7ef", "value": "17B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126554, "uuid": "5bf9f71a-5242-4c36-8473-3249da593752", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126554, "uuid": "16ff5162-6d31-4560-ab46-c18a8d99ea47", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126554, "uuid": "e7bc32da-c0c4-4320-93ad-7b7accd17e0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126554, "uuid": "31348a79-6ca4-4d28-810a-3b1ac9489eae", "value": "document-804094088.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27683e60-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115349, "uuid": "c89c0415-47c1-4485-b596-fce31ae2a8ec", "comment": "Malware payload (Dridex)", "value": "d12ee1794c8f2b439e306539ded744c7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115349, "uuid": "6ed5c09f-b6bf-46d9-9af6-13ba6d513fac", "comment": "Malware payload (Dridex)", "value": "5955f6a8890a11ba8e362ac35a6536f9a307cc9713de45a215853d84eeeb20a5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115349, "uuid": "ec889a5d-380d-46f2-8601-0a6613794851", "comment": "Malware payload (Dridex)", "value": "12f1594f7f9e98dbdab8e137b121fabe42f5c6d7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115349, "uuid": "e17e99a5-eb55-45c5-91a5-44b20861b004", "comment": "Malware payload (Dridex)", "value": "6b8d78f684e494c818a8bcf285c044e01d9dabba5b5bc4be58191b832b9dafce4029c899f86606da75e123cf9865c6ea", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115349, "uuid": "29312719-87f9-4d12-8879-eb59f62e59a2", "value": "1614BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115349, "uuid": "d01531fb-5a95-4eab-9794-177be47d93f9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115349, "uuid": "cee5a73e-92f0-499b-b0f2-dbba583cc65f", "value": "3072:w3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:UJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115349, "uuid": "c010d0ea-0acf-435e-982b-97723cd67e49", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115349, "uuid": "7a188e6c-4f6e-4ddd-a0ff-c27409f14339", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115349, "uuid": "b35341a6-9ec2-41e3-aa1b-ca322ea0eb9e", "value": "5955f6a8890a11ba8e362ac35a6536f9a307cc9713de45a215853d84eeeb20a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83975c72-9169-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617116793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116793, "uuid": "96e4c4f2-ea72-4830-940e-5ff21eea94d5", "comment": "Malware payload", "value": "ac8a85ce29246cc523e264c17a1eeda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116793, "uuid": "04d2d2c8-a630-46e3-9133-02c9df163b12", "comment": "Malware payload", "value": "595736e53ca10cf360d6859269d1ac8d2ee2758da03dc15a30d10c539ca4fd0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116793, "uuid": "bfe0705f-b459-4081-b038-791b96d4180f", "comment": "Malware payload", "value": "e07d50dfd3fd72b6fea16cec751e2811e5d5a2b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116793, "uuid": "0b074ebb-2631-463c-b70c-2e5488412d96", "comment": "Malware payload", "value": "949bda59c6cf0fefdba34f20d00486342cd39b0c0fcabe8d6e8258bfbb6eac1496efd472148f2fddef60267105d02e96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116793, "uuid": "0820cb28-93f9-4ea1-a66d-9b6f4bff4380", "value": "29638709E16C3591DF0E1CF3E0E3F5E84D2842B492BE6567A96C12D6D6CB93F902DC1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116793, "uuid": "d407f427-d5c0-4a18-b8c2-2c936568bc4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116793, "uuid": "5ad7ea63-c035-4213-87c7-5cb504a65086", "value": "768:6M2lKpQImvMJbwmwblgZU9TuCRJQOU2w:xGBD0xd4ToP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617116793, "uuid": "a4910e70-fa24-4418-b407-5cd8e615b9ca", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617116793, "uuid": "fcac78ba-ef20-42f3-b7f6-65dcf47bdaac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116793, "uuid": "47145eab-cf06-4413-9a98-061b26f06668", "value": "Paymonth invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc003fd5-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617108727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108727, "uuid": "9a89ce15-e271-4496-bd46-f3b9cef4ea19", "comment": "Malware payload (AgentTesla)", "value": "4248db2e86af9788f2ab34f04672abed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108727, "uuid": "2c794a3e-fa09-4762-9416-d1795379adb1", "comment": "Malware payload (AgentTesla)", "value": "59643993fce8d1f4fb80e19c721b936d865f44457a718018c405d08226bcc777", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108727, "uuid": "f9f18271-f51f-46aa-bc39-4fb7d2a91e85", "comment": "Malware payload (AgentTesla)", "value": "ff3a3a1cbd426878a473d78deede6c5fe5d51fe7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108727, "uuid": "fe06cd73-4737-4742-8e04-86809a3c966a", "comment": "Malware payload (AgentTesla)", "value": "bf537c637e20dac65a1d65376cef44f05526f14602a85e11683964342c510e978bc9317c4cc763f3f81044fa418f0c4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108727, "uuid": "916aa200-e193-43b4-a028-a0f2140c039c", "value": "5FF4B4AC306E609DDEB6A634F5B55D925FC428320F12FF3B249327446C5B76AFA0E460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108727, "uuid": "42b0c012-139e-4bc9-9dfe-7dba1aa62ea5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108727, "uuid": "68c03ca9-f658-4e2c-b767-e5663414545a", "value": "12288:l8FtDuXZnX67TD6w7v4XE1KDfB49gMiYglFtKX+RaII5TaON1wf:lSDuXZXKWYde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108727, "uuid": "a7e98cf5-c513-4924-8522-7b98a4342ba0", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108727, "uuid": "27ab67f0-21c1-4e1b-91c4-26a0a16f601f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108727, "uuid": "c2fd67cd-98cd-4d37-91c8-0bc597784214", "value": "4248db2e86af9788f2ab34f04672abed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc3e009-9196-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136113, "uuid": "5b51a24e-4928-42f4-977d-7330fe1c4fd6", "comment": "Malware payload", "value": "7298f0431e34c7f9768ce3e8634c98f3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136113, "uuid": "e3ccf0c7-33bf-47dc-8237-ca6e251d18ee", "comment": "Malware payload", "value": "597ca9bf40a383ba47a75a449b41a3617ae47f9ead844d54dc1e42504a177525", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136113, "uuid": "7ece8699-2f58-4aa0-9fcd-38bf21d46e53", "comment": "Malware payload", "value": "45eac8387c0c07039a8ea3fa56712e022b47ed43", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136113, "uuid": "62ac3d9e-16b7-4b76-800c-2f091502aa18", "comment": "Malware payload", "value": "2035878175ac7d0c7d616521dd6926955c59b7485eb3dc768b7f7062afa4cc765d8923acac84a5fb916689effc3917ca", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136113, "uuid": "d4a0c351-bc6b-4fea-874d-1116cc33f394", "value": "5414BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136113, "uuid": "80694d9b-b9c5-447e-b5fb-f4946f28c87e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136113, "uuid": "324cef74-1ae3-45ff-a19e-d82b6a51f64b", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136113, "uuid": "c637797b-a26a-4b54-a678-22323492888a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136113, "uuid": "c69fb6b2-7e1d-4e26-abd2-3d33ed3ac41e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136113, "uuid": "9429ada5-1e01-46f9-8f63-2ac901c911df", "value": "597ca9bf40a383ba47a75a449b41a3617ae47f9ead844d54dc1e42504a177525", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672a2346-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136931, "uuid": "1c5b0c64-5e4b-4c7e-a630-caaa68e76102", "comment": "Malware payload", "value": "00aa6ec5c2fb43ad49b6344b6a906897", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136931, "uuid": "a2141132-90d2-4655-bb6f-09e0e0829d49", "comment": "Malware payload", "value": "599dbc66b86019c1a8b54113c544f0c3d33efb040346c45940c3feb671f6f9a9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136931, "uuid": "b870033b-d93f-4d6a-9e71-ee2b511a977b", "comment": "Malware payload", "value": "0ab637bcc3267227edc06a4bc4a7add5d05c8639", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136931, "uuid": "72afcf24-b437-4364-9241-9405c1737207", "comment": "Malware payload", "value": "5344b2ac3216cc0ab851aad12a2cc164c5b3d00a25e5a238f98c52aeed06f27a9b91b8c446e78c26de3b4cdd91d7ccd2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136931, "uuid": "1d294c83-06f9-4f93-ad5d-08f4f3438edd", "value": "E314BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136931, "uuid": "0348128b-104c-4274-94e0-a1e10e21f918", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136931, "uuid": "bec3361e-7c8a-4bac-9740-9c788efd4b21", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136931, "uuid": "710860e1-d642-4f37-bbda-a60db4b5e314", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136931, "uuid": "142137f4-b505-4f8d-a7ec-a4e45bc80ffa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136931, "uuid": "de9cf3ba-48ef-49d3-9e00-84bcf2acfaa5", "value": "599dbc66b86019c1a8b54113c544f0c3d33efb040346c45940c3feb671f6f9a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bff188-911e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617084671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084671, "uuid": "c65c0ca8-30d2-45ad-a77c-dfd379a95b40", "comment": "Malware payload (Formbook)", "value": "b59b4afacf4ba873beb7844b8b36eddb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084671, "uuid": "a5f2fbea-46e2-4875-9180-2e0b97056120", "comment": "Malware payload (Formbook)", "value": "59d2fd7f189341c01d231995814ee1bb04c36c92a546e97e78b2fd110df7f1e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084671, "uuid": "e3682b4e-f764-4f7c-8886-362b3459049a", "comment": "Malware payload (Formbook)", "value": "26900cf0c3c2af8e99495fc29d4c30b38537e600", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084671, "uuid": "fcb9eb63-34f8-40b1-9065-ce91f6e3d27e", "comment": "Malware payload (Formbook)", "value": "2f28e8847b78ffb1c114fcac398a14a43580976f8fd6540eb728495a2ea4d2e6fa6b071d7b34888e6e79cf46c3f1a896", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084671, "uuid": "54317377-cc87-4966-a828-ce9b7392bf79", "value": "00D5330229EBA748E17FE475E4FA867D079ACC08A9459C4533DDBB2135B22317BD331A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084671, "uuid": "5f5bf843-152d-44ad-9b8b-88736fa64e98", "value": "49152:+EHgnUxlBX8FVKJdd2SWnSvh1GP9tSmXyA+GnKahUpy7B:+EHgqlOZSmVtVCDGnhUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617084671, "uuid": "b17daf21-6c90-4d95-a535-df6b2107b6b9", "value": 2768384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617084671, "uuid": "c4c04e3a-e033-4a7d-939e-a5cdf9386ab5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084671, "uuid": "5bca9f83-38c3-4044-aca8-eae3cd3e7169", "value": "RFQ 4168.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9ec3e9-919f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140185, "uuid": "dcad061f-1352-40f4-812b-d3a1d07a3704", "comment": "Malware payload", "value": "dec111e06684eb4b4d4cbc051c85848a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140185, "uuid": "122aef22-c03f-4008-85da-5011cb6d6ea1", "comment": "Malware payload", "value": "59eec99c212acd2c3b7951bc185df08230070ae3b47cbfe794b555387c97a9a8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140185, "uuid": "5992de60-44f9-46d5-9176-694c122a3270", "comment": "Malware payload", "value": "8abe067c5c8dca02351abfb8693581020bfa66ec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140185, "uuid": "abcb8a13-ca00-473d-88c4-ec94e7b45e20", "comment": "Malware payload", "value": "be86e317e73f4ca01acb057769bf65afec69476823a40f16026413f16d4f179dffb97f3be1f7735122900855e9a986dc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140185, "uuid": "2f45500c-e3da-46ab-924a-764d39328dd7", "value": "1C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140185, "uuid": "41e4a1e3-2e2e-4f2e-8782-468837d1710a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140185, "uuid": "647850f5-863e-4483-a701-0551b6b3f0f0", "value": "3072:R3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:JJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140185, "uuid": "71ce188f-df8b-48cf-b87b-49556f405a0d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140185, "uuid": "17af5218-1009-43d0-aea6-a8c4671b539f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140185, "uuid": "8e67096c-a773-472b-80bd-e3ae9da677fb", "value": "59eec99c212acd2c3b7951bc185df08230070ae3b47cbfe794b555387c97a9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a5ca24-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142727, "uuid": "bc617742-679a-4695-b799-0a3ae1cfeea7", "comment": "Malware payload", "value": "0477d97d775992ddf09d6e0ba5974448", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142727, "uuid": "66cac3be-3df4-4599-8853-67983dfe186e", "comment": "Malware payload", "value": "59fedaadd64b5ecbb0409d9d0dcf85c0acb93950094d686e913f702845a4c1af", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142727, "uuid": "21885570-1eec-4112-8efd-432ea68f58ce", "comment": "Malware payload", "value": "64d758105262eb5400bbca7078164c76dd3ce862", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142727, "uuid": "6d8e7961-9d67-4a18-b214-13c85c336192", "comment": "Malware payload", "value": "b49d8e93db9b889711c906979373e65f501302fbf70d20864b6cec0014fe860a00d8ca25db0d9848ecb9385bcd34a842", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142727, "uuid": "22bdeb78-3e83-49e4-86fd-2fee0ae9636e", "value": "0014BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142727, "uuid": "4540f853-bb30-49e6-b440-6ade31132994", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142727, "uuid": "f8e85895-e756-46f6-841e-cf04e497870c", "value": "3072:I3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:sJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142727, "uuid": "1ab2ec5a-11e0-4e20-b6d6-ace630f5b1de", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142727, "uuid": "657716dc-63b8-44a0-b0f6-246dfdfd5aac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142727, "uuid": "91289cb9-1790-426a-837f-ec2a8e176f8c", "value": "59fedaadd64b5ecbb0409d9d0dcf85c0acb93950094d686e913f702845a4c1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ad96a5-9184-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617128366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128366, "uuid": "36445ccc-a53f-43d7-8fed-3c7a2b4d5021", "comment": "Malware payload", "value": "0259b15cdf109df94e75b84b4274fc13", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128366, "uuid": "4487c1e2-c428-4c6b-954c-17155bc14a80", "comment": "Malware payload", "value": "5a045d2a37de09d40dbe0c812621de1d7e98dbd6f93516f883f1a6180236f99e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128366, "uuid": "eae2deb3-5c75-4be7-b6f7-5daea5308d4d", "comment": "Malware payload", "value": "89a7376390cb1a891197acb405a6922af582b5ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128366, "uuid": "45789ca0-33a8-4e93-8351-9735f453a8fa", "comment": "Malware payload", "value": "3beaa9489d7606a6b85b7347e2689e825257e11c335f715d92ddbddea27ca3aef0d8945fac6623446653e2510b725d40", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128366, "uuid": "114338fc-d65b-4518-9653-a3270335714c", "value": "ED14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128366, "uuid": "65ecee96-aca6-4ddb-99b4-165f0e362b14", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128366, "uuid": "e92266b9-e593-4ac8-a4cc-ccf827c17089", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128366, "uuid": "5695234f-1bcf-44fd-b6f4-8bb37fea903b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128366, "uuid": "35de8e93-c64a-44e3-bb0c-3a9bda2a0e03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128366, "uuid": "f86b6513-2b5e-49fc-a171-a5899ce40019", "value": "5a045d2a37de09d40dbe0c812621de1d7e98dbd6f93516f883f1a6180236f99e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c633cb-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123098, "uuid": "2ae50bc1-ea34-4465-b597-f4ffa722a880", "comment": "Malware payload (IcedID)", "value": "9462b461ea73522d235838eea531b8d4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123098, "uuid": "b5388bac-3776-4009-9dd2-0e9516cbc7c0", "comment": "Malware payload (IcedID)", "value": "5a30df44aa1934115e77961448b0b2c019f6d703c5313ea4f9ba557b77b730df", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123098, "uuid": "f81feba0-fe36-47a4-94e4-31dd0bede78d", "comment": "Malware payload (IcedID)", "value": "00f3125d429d9b80e17190efb412f8559409e71a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123098, "uuid": "910d0954-9499-4f24-b231-f43865da49d2", "comment": "Malware payload (IcedID)", "value": "f17dca00a20ab92e859296a1e3287fee89a7a151765baa521c2204688dff6dd50424a6037494c7c3124e1e06727769cf", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123098, "uuid": "5ad53dc0-0826-4120-96d7-62f9b95f521d", "value": "BCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123098, "uuid": "ea8fdb2a-fbc1-4e3f-8237-72eec2458bc5", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123098, "uuid": "709ff8d6-9e2b-48b8-a671-93b47a2ce70f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123098, "uuid": "967d9470-f781-43d6-93aa-ee47829b361a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123098, "uuid": "f797b08c-be81-4130-864c-3a7a0dcbc564", "value": "document-1527488328.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebdbe995-9148-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617102794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102794, "uuid": "60ef8196-3ca6-4ae8-a5b6-4730dc13e719", "comment": "Malware payload", "value": "e8b6f561907abcc1c13972cdd6a9adb3", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102794, "uuid": "2170320b-8ec4-4d6e-987e-9e939fc4e270", "comment": "Malware payload", "value": "5a52ea492f04807e36c3ec95a8dd587b276739c201f529907595942f1aa7dd3c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102794, "uuid": "e74e9118-9dac-4d40-8481-6662f191df9e", "comment": "Malware payload", "value": "1da8024e69a7c87fdfc8c100c1f1de641e27e190", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102794, "uuid": "4ca8cc94-a95c-4712-9387-dfac69f8a081", "comment": "Malware payload", "value": "6602ce1194f1e35715ec85de08eddcf99781f0b94886f397057f5ffcdb042dbcd53541c152233a274b9ce7d5800fcc1e", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102794, "uuid": "28ddeb10-8351-412b-9da0-e4ff2c326b4d", "value": "27F4334D10D9220BF2C95ADBC04955E623CE8AF3D74BBD3E2125314BB6A4B1AD4B4E36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102794, "uuid": "18b035e6-d883-4f89-a556-f5927a5b8b1c", "value": "12288:UrW7Q6umYgcZrr0MMhrjyXxoDrgB/9+P4hBJcf7krqSjCZFg+MPOqU4J3xrLwh4+:UrW5dYfDMpyBePP4rJcQrobgTLUM3xrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102794, "uuid": "4739aa00-c614-46c5-84fa-7b003a2e76c2", "value": 771498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102794, "uuid": "24b8564c-6548-4d01-adc5-7f1494819f30", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102794, "uuid": "f442a1c2-7684-458c-a228-a07b06629cc2", "value": "bank details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b70d34-9182-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617127503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127503, "uuid": "4033603e-659c-4170-81ee-926d601fe9e5", "comment": "Malware payload", "value": "f0b60121df818612677a8ead489a7182", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127503, "uuid": "8dbefc37-68ee-477e-9caa-ab0828bec91d", "comment": "Malware payload", "value": "5ab72ec5c3f14503090c0471f0bf2302d44a1155814eb89cbe066f38aa8f3e9c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127503, "uuid": "cf7fdf93-0edf-400c-8b0e-92f882862dcd", "comment": "Malware payload", "value": "9e9265315c0af11ca6bbfb98f7112bd128d319b4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127503, "uuid": "b56e5cd9-a204-48af-8910-ac71b1b57d36", "comment": "Malware payload", "value": "36e403156505d3460c2e3ef8ba742c7a31fc30d820343f8a03f823546f88efabbb5b754d2bd5cd9698a942ced4eed1d1", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127503, "uuid": "f7e825ba-fefa-4451-8bcd-e8acc43933e6", "value": "BA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127503, "uuid": "1ebb129b-2bd8-42cb-bb8c-87b181d236c6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127503, "uuid": "b1198330-bee9-420e-ad8a-39cfc567ed80", "value": "3072:P3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:nJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127503, "uuid": "2aebee9e-9565-4d0e-89c6-f52ba1d31f5f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127503, "uuid": "100c1bc8-b824-417f-9ab6-24be3708d745", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127503, "uuid": "5d19009a-9476-485f-8ecd-5fc775511197", "value": "5ab72ec5c3f14503090c0471f0bf2302d44a1155814eb89cbe066f38aa8f3e9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c195ebc-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (Amadey)", "timestamp": 1617088057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088057, "uuid": "e980857f-31f5-4b87-a1da-4832670b48d1", "comment": "Malware payload (Amadey)", "value": "faf9368f40e64b2ad9d47b1b6e0b958b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088057, "uuid": "209f47f9-32f9-4562-8c7d-311a3968db2e", "comment": "Malware payload (Amadey)", "value": "5abccf6b1cdcdb5eff6c00de089850a6f81b0813f2afc3b79d4d681defdabf95", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088057, "uuid": "9acdf6d1-695d-4e30-81d9-cc94541d9e99", "comment": "Malware payload (Amadey)", "value": "2531f7690b37dc1b11d1c6d36ce91dea22425742", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088057, "uuid": "f005f083-e727-4af9-916c-1816af010249", "comment": "Malware payload (Amadey)", "value": "1c78b9f503e84a9331a475d37889cc81cffd929b93cb45d73958724eb5ce087297d2ea1b341eea3c69a934d0fe28c5b0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088057, "uuid": "9ce7aad5-5db8-463d-98aa-8c515d7a5923", "value": "DA33B6199344F127D1A21A355922E878370DF7345C81720DDA92446CCFA6AEEFCCEBDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088057, "uuid": "0a1a4550-fa37-46ec-8c46-b703cc850b73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088057, "uuid": "6642045b-79dd-4e61-87da-9ed8be9ffd43", "value": "384:l8jTThbyEku1Ka4XhHeV3wjiC6+Ma85dHjPEQzydqrYuhRxqtXcTu2OhdxE9hWZG:yByENK9h+rlRajoh4TOj4J4O0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088057, "uuid": "80c48194-0482-469b-acf7-6a764770cddb", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088057, "uuid": "79eae0e4-860b-458f-85c5-5ee43bd6ed37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088057, "uuid": "af156812-6a09-4e52-a8ce-0ce54203c793", "value": "faf9368f40e64b2ad9d47b1b6e0b958b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d63134-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114065, "uuid": "dfd1503c-ce10-40e6-b212-37e681b42cd1", "comment": "Malware payload (Dridex)", "value": "ec23e2a4f54ba01ab0bb6702e034bc6d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114065, "uuid": "b3a003ad-3b57-4cbe-be1f-6e6889cba3dc", "comment": "Malware payload (Dridex)", "value": "5b6eeb534c045d1563b03deb54c56196fb72257098fcf15bd4710212d1e30595", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114065, "uuid": "b56ebb37-b9df-4f42-bfae-67c88d5dc3a6", "comment": "Malware payload (Dridex)", "value": "64678a04289b3ba7294338949d430148ebe41fe7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114065, "uuid": "b3489119-586b-4ab7-a8a6-bddf4a171f21", "comment": "Malware payload (Dridex)", "value": "c7843db2d4c2af42894062b359f0efdb259ab056d3a45037b31512c15b6109b06b03c2409cec4ddf028c2e0dccb99b22", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114065, "uuid": "5e8b501d-e357-40a7-ac2d-37d5813cde75", "value": "9814BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114065, "uuid": "073addcb-f3d5-4362-b31b-fbae66b1ee58", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114065, "uuid": "f5c122d5-5b9b-4fe3-b632-72b835e15b98", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114065, "uuid": "3b9e2337-1b3d-4e0a-b35c-4aaf71f8cb43", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114065, "uuid": "24412107-d162-4cd7-b333-b1af96403602", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114065, "uuid": "a0812367-da37-4711-ad48-c9638fcf015d", "value": "5b6eeb534c045d1563b03deb54c56196fb72257098fcf15bd4710212d1e30595", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320c58ef-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "9396c3b5-98a1-401f-9ef9-cbb0cd5c8568", "comment": "Malware payload (Dridex)", "value": "50e109fa0bd932b66a0616b3adb01bb6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "7a1cb57d-95b7-4666-8ec6-559e7e0caec7", "comment": "Malware payload (Dridex)", "value": "5b7ce3ee7270317805d3d168d139a46f8dbe0da5fbf3cc9bf5dd73d6e1bf799b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "38d5a0bf-ba1a-47e0-9e96-7180c92930c8", "comment": "Malware payload (Dridex)", "value": "999c0091c5f98e16e5466f377b927f155bc6f04b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "89908c54-57d7-4f87-a752-85fa2511af2e", "comment": "Malware payload (Dridex)", "value": "a3d4d4c49359c8cf5eab6a33032357abc825bb73846d23e3fa5f9b4d677b648e9cbb4e88bed3f26daac19213477618bd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "458d9e98-600a-4303-8de2-87ea62a810b4", "value": "A314BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "a2dc10dc-c833-42c5-8757-c91494ab6f3f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "88a300d3-40ae-41f9-8d9e-27cbf7ce2519", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114079, "uuid": "2c223b44-fc03-40de-a29f-fb9509b03baf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114079, "uuid": "3231b3eb-3916-458c-9f19-851e51fb91e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "ce2aa43a-4c97-4599-b251-cce0bb5124d6", "value": "5b7ce3ee7270317805d3d168d139a46f8dbe0da5fbf3cc9bf5dd73d6e1bf799b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e6508f-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137095, "uuid": "ca74e79f-755a-448d-a93d-dd3e900d0418", "comment": "Malware payload", "value": "39f3d51d30fbde98b7f278247849205b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137095, "uuid": "f0abc346-2921-407b-89bd-9d2937911137", "comment": "Malware payload", "value": "5b9171f57850be269f9c1b32b983b0888a75ddf9c2d86617408216ea7ceb4d45", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137095, "uuid": "03596649-7407-4f7d-9365-5456700ac028", "comment": "Malware payload", "value": "89e7b87a1cc3ec355027654172b0f91cf0f0f778", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137095, "uuid": "72777648-ecd6-4ca4-8d1b-fc5135642786", "comment": "Malware payload", "value": "e89fc27bbcaffd887b41b716968998e6298c727c847b27249f2834e3ad4784d33006f850fea10da80e7117514d93cb87", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137095, "uuid": "6f2a6b37-1262-4f6a-9398-f61bb859c7fc", "value": "9D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137095, "uuid": "113442c8-86ef-4d0d-b6d9-429003ee3766", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137095, "uuid": "f08404a3-5bd2-4f8d-845d-84e768ebff34", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137095, "uuid": "c69bb4b1-7884-41dc-a786-f431620213cc", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137095, "uuid": "da176c52-6a28-4395-8e16-6f69de6224ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137095, "uuid": "69fce12b-7a66-4b0b-ad10-a670d8775b2d", "value": "5b9171f57850be269f9c1b32b983b0888a75ddf9c2d86617408216ea7ceb4d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f10d20-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617105487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105487, "uuid": "16bd663c-15b9-45db-bfae-c9fe10913279", "comment": "Malware payload (AgentTesla)", "value": "71f80ba3475d0501189c12d57c76eab8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105487, "uuid": "f016a769-865f-4f0a-b342-4082d1e0f5bc", "comment": "Malware payload (AgentTesla)", "value": "5b93fbf61a14ffa5c77d937655fd99c3a91d60731688482f85081ba362a83ac8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105487, "uuid": "2cbf28b9-0004-43da-b9d1-f96fd32081fb", "comment": "Malware payload (AgentTesla)", "value": "5f5252613c11508ab347db82754270a88051dd39", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105487, "uuid": "53678e8b-22bf-4062-affc-a0cf17b3d8a4", "comment": "Malware payload (AgentTesla)", "value": "10a2041a5b154cbe6c949afb81d7b5cbde9ec10b422c2e35773180dfa37f21b5a5fc01ad9b8cb2b1d0d41017ed7caf38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105487, "uuid": "ac601849-c4bd-4a6a-8079-6111ee3cf288", "value": "5683AFF879047DE6556F576BDE87BCDD03A636628A8BA4C890B9BBC30163365EF01C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105487, "uuid": "0b191430-77b4-4db4-b2b1-bead3ee98eed", "value": "1536:SF1CuPyjBcn5JOk5HL/sD3YcJqf4+TqI5He3q4Gbm4eY1FKsZlG8jCFDZUvD9qYl:+1Cfju54qHLU3YcJqf4jK2Z4Y5w4F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105487, "uuid": "b240057d-7209-4c1d-a58d-3eb6c5dae17e", "value": 88210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105487, "uuid": "e1cbd60d-7dff-4df3-82b0-988fcdcac216", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105487, "uuid": "74cfa419-a449-4e32-bf1e-b2e421ecf525", "value": "Urgent Order-MBDPO12-210300476.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac01b47-912e-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617091545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617091545, "uuid": "5876f4b5-e636-4b9d-9c09-b54937d6fbdf", "comment": "Malware payload (Dridex)", "value": "30124dbdde70f235d9e969ed78ab6983", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617091545, "uuid": "f80542d9-2e55-4c5c-81b7-eedb20991c73", "comment": "Malware payload (Dridex)", "value": "5b9ed9a62f65a839e42a545fb0e8e5240996030f53e3a6c6b113d18bceb008d9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617091545, "uuid": "ec5d7e1e-52d1-4876-8a71-d5f691b6e8f7", "comment": "Malware payload (Dridex)", "value": "bd3d816c36424b4bfe6ca6bbb20be7a88da5b780", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617091545, "uuid": "e6649dd8-a1b8-4195-95ce-08f0d9227370", "comment": "Malware payload (Dridex)", "value": "e123e21b3fe7f33362611b74e49ef84b8233ec5e4f60af3997fbee50282fef5f2074bdbc73e4ee5a13318a6426efe9cc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617091545, "uuid": "e20f2f8c-af3a-4463-9ed1-f88df75319ef", "value": "7814AE9DD729E464FAF3D9F104359A1210BB6C49892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617091545, "uuid": "aa28e40f-3de6-4a6f-9274-813228a7fc32", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617091545, "uuid": "6f6a7296-cff3-4c68-a062-2bb22f827e66", "value": "3072:G1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617091545, "uuid": "861e0ded-54b4-434c-bbcc-83f8ff2723d5", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617091545, "uuid": "8f2f0085-424a-4fc3-889b-56ff622d7039", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617091545, "uuid": "a92969d1-c7f7-4e11-bbe0-b4b3e670cb0b", "value": "5b9ed9a62f65a839e42a545fb0e8e5240996030f53e3a6c6b113d18bceb008d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dde15bc-9185-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617128809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128809, "uuid": "dcf37b53-df7a-4a21-9645-cbe2aba542fb", "comment": "Malware payload", "value": "2c45ffd65c218e38ac099f88ac6e3485", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128809, "uuid": "3c248468-f3eb-4406-9f80-9c3b343a7316", "comment": "Malware payload", "value": "5bcfdddae9b99101329a7e565103a8480ffa3279af22823e3148102fdb00227d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128809, "uuid": "7916746f-cade-4796-b63e-7661275e87ee", "comment": "Malware payload", "value": "04aa9d9bfe14bea9a0f0d7f9a0caab1858ff5ec0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128809, "uuid": "52aecc1a-85a1-4265-a062-fab39bd31a82", "comment": "Malware payload", "value": "0db769dae4f8601b055a929f51c8c0c8cede45c0e288a5fab73d2d91cbfc5df1d9fa117a57f2e698dcccb36cd598dcea", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128809, "uuid": "0a339bf4-4902-408a-b633-1c52b9c65cc8", "value": "F214AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128809, "uuid": "3de09fa4-d68f-4a57-b5af-fceeef6441e9", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128809, "uuid": "c5777955-19d6-4427-8374-793dfa5a065c", "value": "3072:31i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128809, "uuid": "67e87f2e-0b9b-4c06-89bf-3cbde32156c9", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128809, "uuid": "10baf9d9-a6ba-4ccc-ab13-dfe56c721168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128809, "uuid": "e4bdb635-4d62-44eb-8a1f-7f0a4685e52f", "value": "5bcfdddae9b99101329a7e565103a8480ffa3279af22823e3148102fdb00227d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a3f432-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114385, "uuid": "48a1524d-aaee-4d2e-bcf2-be0fc0a30241", "comment": "Malware payload (Dridex)", "value": "6da80b25dc1067b25dbb009dcf7e10db", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114385, "uuid": "d4f09569-5e58-40fa-ac78-fde99463ee7d", "comment": "Malware payload (Dridex)", "value": "5bd0b7664664ee3f158177907f0127d9a1d8e2a05f28504db00f211870360808", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114385, "uuid": "7af05a15-79dc-4730-8347-ba7c39364545", "comment": "Malware payload (Dridex)", "value": "6d51b6f5a5908415ef7cf0e4790e1bace52404f5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114385, "uuid": "fce93e9a-19c6-4a20-9b04-251efdd0333b", "comment": "Malware payload (Dridex)", "value": "05628aa2c3ac1b87d92e049f1e74b2e4e6ca9ce0bc315749846fb5513814740b0532d54ddf3b031f2faf274c967d9192", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114385, "uuid": "969f4c31-5631-432c-a701-5da05f977025", "value": "DA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114385, "uuid": "edc41ca9-4b0f-4f21-b637-d435cb62d774", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114385, "uuid": "f0de764d-a5d6-4093-b06e-a3e9bc151f25", "value": "3072:r3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:rJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114385, "uuid": "f42e5ebf-6f4b-4dbd-a18b-846b069a8242", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114385, "uuid": "c9882dc1-320f-4c9f-9b8b-c34b49762d5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114385, "uuid": "411ef2e3-b79b-41c5-a830-92c7b23f5d22", "value": "5bd0b7664664ee3f158177907f0127d9a1d8e2a05f28504db00f211870360808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9471e30-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108695, "uuid": "e0e33529-6f22-4167-9ab7-a59550ef7af1", "comment": "Malware payload", "value": "6cc19decfb6c506ac8247a8886fb5ed8", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108695, "uuid": "608a0ba4-7735-48b5-be6e-d07fc18a8918", "comment": "Malware payload", "value": "5bddf6a51b232c883e057d9e5eb16f178a59ee38c456c8254202b8572cb1ace2", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108695, "uuid": "cbfc20b4-27ee-443b-a59c-5c1a487e4122", "comment": "Malware payload", "value": "ba2ab0d826bfd8a0f702fd2055500a1bf5b7d30a", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108695, "uuid": "0243906c-1950-4c76-96d0-0a5cd44f9c7a", "comment": "Malware payload", "value": "7fd16dc5dc5450309872b986623795507d582b7d0676a6b655028c653d2f65dd3f437179d716865a8e7db736c8dc6e05", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108695, "uuid": "32902780-9476-45f1-9a3f-cec64fd40477", "value": "0B83127EAF68CCB3541A8C64705C90DE99A028D461AB0091FF566EB0BDDEB78830F725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108695, "uuid": "4e6910bf-92a5-471d-aef7-8c9f62e68780", "value": "1536:liLMueFz89puS+TsZ7QOE/x6Sau+iSl0/cboeZG5SKIOdrcxIQ4tj:l1uWYWTsZ7xgSl0ZlIq4xIPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108695, "uuid": "d1846901-6ef8-4274-b86b-544499f1d5fe", "value": 84137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108695, "uuid": "83e5f8fb-156b-4695-a3a3-5c4162a91186", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108695, "uuid": "f30afd39-a489-4705-a47c-b1384e91004e", "value": "licenza_1565.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a11c88-919d-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138908, "uuid": "bab5ed77-445d-402c-b413-d76cf620b182", "comment": "Malware payload", "value": "0f6fc9e8f4a8d28e80c087a568e1ac40", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138908, "uuid": "844bf8c9-d1a9-4e7f-9c0d-593aff7c12d4", "comment": "Malware payload", "value": "5c8854f15b9d3835936d80165eff34acf91c92ddf648c033596383f80b6df9a1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138908, "uuid": "431e2ab8-3e18-4f6c-bccf-8655a81effe5", "comment": "Malware payload", "value": "070ea3b6eeac48f209ec00e99c7b13c887880039", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138908, "uuid": "8c569b26-4ef3-4d47-ab2f-4923be3eaf26", "comment": "Malware payload", "value": "f9ae161bc252cfcbe914c8ff63c38060130a53f4ad25a54a9b813761eed456ecdd7ad39d33620c913f00d8d4ee4b8b25", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138908, "uuid": "bcf23f25-e07a-4b9b-8fe8-e162489b23d3", "value": "5514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138908, "uuid": "f4904732-e2de-4d60-8441-8e27107ef251", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138908, "uuid": "44359901-9f43-4418-8461-d9a8e0241c25", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138908, "uuid": "ef7f1d58-9786-4b18-8c19-eeba42cc956c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138908, "uuid": "a9b35f05-285e-484c-872b-6a52d651d0fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138908, "uuid": "35387e1b-5869-42ab-bc19-9e5b1af66730", "value": "5c8854f15b9d3835936d80165eff34acf91c92ddf648c033596383f80b6df9a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1fffa9-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126256, "uuid": "fab2f619-2056-4dc6-b7a7-c9a8ce6e342e", "comment": "Malware payload (IcedID)", "value": "38ae336c2eb2f2aa1ea887f2da872762", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126256, "uuid": "15b7e12d-7be5-4528-a60d-ce673592710b", "comment": "Malware payload (IcedID)", "value": "5ca4e309c734b09a0c2e884bbd5aab63d3243b754d36c22c627af51d36ee4408", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126256, "uuid": "45c4f59d-5395-4031-91e6-934e409f1702", "comment": "Malware payload (IcedID)", "value": "0e15952b003778b26f5e4c6e8179c0adef387aa9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126256, "uuid": "606c41fc-9af7-452b-a231-20a9bdea3caa", "comment": "Malware payload (IcedID)", "value": "f42d7df403b1bef025102a095e5db8f91b98cdecd951d84261d661c9f0daaa3b8c73dc020567e3910021a76a828c6841", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126256, "uuid": "12fe8ff8-7988-4729-91b5-2c649bc54e02", "value": "22B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126256, "uuid": "820bbffb-2391-49a1-8934-e139cc043e59", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126256, "uuid": "6cab1abb-6a21-4700-92b9-d1c6a429cfe8", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126256, "uuid": "dc0ba10c-4ec3-42e8-8e53-79fd8fc6423f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126256, "uuid": "cedf362b-06b6-4566-8dcf-50dfbadb1d41", "value": "document-367436373.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1297e3e6-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114455, "uuid": "a35da483-e03c-4c82-ab61-44fb1dfdcf7f", "comment": "Malware payload (Dridex)", "value": "3494e009a87436a378d360e7ff07df91", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114455, "uuid": "afee2938-ed46-42f6-9c65-69843f34f227", "comment": "Malware payload (Dridex)", "value": "5cd54b5e918930034ac179c7962ea492aee017dbf9b366e094bd3a97b62ac52e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114455, "uuid": "d12c99a7-1da1-4eaf-b704-689e972167c5", "comment": "Malware payload (Dridex)", "value": "1630fb1b1e384608f2f834463395a8139df9bbf5", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114455, "uuid": "95968083-3f65-46b3-9a9c-b75bc4032fe8", "comment": "Malware payload (Dridex)", "value": "fc47567b090c0cf93456f6e7f6e013a9cdadad79a46249562248bec3e16b7ea3564bf5b54e47db22634deca3fdc68756", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114455, "uuid": "07c715a5-5894-48aa-92ac-571ac39c6043", "value": "5A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114455, "uuid": "5d4dc414-2332-4246-83a3-178b161072e3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114455, "uuid": "f6a62968-6177-4148-9f89-f09d6a408be5", "value": "3072:I3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:sJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114455, "uuid": "376e9187-5ce4-4bcf-9d6c-bbae05260579", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114455, "uuid": "9ea9a29b-7fff-4465-b4c1-dc24ca73e32a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114455, "uuid": "22fb6d71-3136-4c88-99a0-f2f2e8e9e074", "value": "5cd54b5e918930034ac179c7962ea492aee017dbf9b366e094bd3a97b62ac52e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa021ec9-9154-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617107972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107972, "uuid": "e685a01b-bd86-4bcd-9de3-1c0444d02dbb", "comment": "Malware payload (Formbook)", "value": "a48e06c3a59cf8ea0b885052b35b771f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107972, "uuid": "647d7742-262a-4bb4-8f57-49c220b77b50", "comment": "Malware payload (Formbook)", "value": "5d2f85317870b3c5918ae00246638da3b0cf49a5ccde1568e7e1e9a052d69235", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107972, "uuid": "5421fe63-c940-4c04-98cd-be91628b1076", "comment": "Malware payload (Formbook)", "value": "ef00ac073aad0596c520cfc03e9c82a10ce6a3da", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107972, "uuid": "34904d31-ba79-4579-a763-e25c1891bed3", "comment": "Malware payload (Formbook)", "value": "51f52a4ab16a69d9a3611fd042d56a1cb34019000538b32cd38a93e88b84a24d856a1c2d8e6b020bf8296e90cfdb20f7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107972, "uuid": "4a082b02-3fbb-44c1-978c-60d076eec87c", "value": "D415B28C1D9AC0CAC9350B788ADDD4F556E95FF30B2288BAB5C47FEBE431741E10A526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107972, "uuid": "84a3fa05-79cb-4349-8a37-6ccb880a48eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107972, "uuid": "d15c5b79-05f3-4185-8ff2-4e31bcbbce20", "value": "12288:VNQgMhltTmSJ2iNVPIiXTWe23NK6/E9mtWBQUbLpuzIX4I:VagMhltTmSJ1zjXKBY689m1bMI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617107972, "uuid": "5571c5fa-d727-4a72-a310-4f0aad635343", "value": 900096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617107972, "uuid": "886365a6-9a9e-42ee-ad61-e6c614986327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107972, "uuid": "b63e2b52-6b1e-4176-91c4-997552aae9af", "value": "Item pending delivery - Final attempt to reach you.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8e8a23-916c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617117990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117990, "uuid": "d071c7c3-8d3e-4a4a-bac1-fc9804dc48db", "comment": "Malware payload", "value": "784222ba7304e43b5706310001351df4", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117990, "uuid": "5cb8077d-b3f9-4976-b621-55dc6c0553fb", "comment": "Malware payload", "value": "5d554504d7a0cf0c5b59e0365927ccb9632b985bfe94519d68b86585ed4be0cb", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117990, "uuid": "658fcd8e-d4b3-4df6-9e59-c1aac4f0310c", "comment": "Malware payload", "value": "5a886c5d447597026aa12e35ca7a0fc4c8ffe31b", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117990, "uuid": "420eb33f-60aa-424e-add8-0d05c51ac175", "comment": "Malware payload", "value": "96df718c5d5e588d088eb1e32d8005696670bcfc1cda533305fc53f368fc53d98ee1be36c686ec5415f1255dcf7d1448", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117990, "uuid": "2c2a3fe4-d79b-49bc-8f92-f7705d5ffc39", "value": "5951961AF947D15C9BB5236BDC97C962FF1B401B9DA2100C71DCC2495F3080996ACB9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117990, "uuid": "48ab9aba-5c26-4922-8e3d-c955e36584ae", "value": "48:Axl+43iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozf:CrGhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117990, "uuid": "0b72e7b6-8b45-4aa9-a9a8-020767ebb3f1", "value": 3143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117990, "uuid": "ce454fa3-93ec-4461-b7c9-6c42624b6b4f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117990, "uuid": "ab2a7d1f-448f-44de-ab60-341203eff66c", "value": "77Jhk0iw.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8af4b-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137234, "uuid": "737cbe23-bc56-4d79-8cc8-afe1e1eea0ae", "comment": "Malware payload", "value": "c99f79746b7b9efaf3eb5019114e0e23", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137234, "uuid": "8e23fee0-8701-42ef-8f99-8bca345b2b15", "comment": "Malware payload", "value": "5dcec1a0b243300d7ba28438b7af8ec291ed73901a3859e01a6af7f1bf093347", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137234, "uuid": "775fb500-e3e9-4170-bf5c-fa18b259cde3", "comment": "Malware payload", "value": "ff6b59385c38da2bed01c85a9bc5da501b6daef8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137234, "uuid": "94049e92-7713-4c4b-ab5c-b8e175be2969", "comment": "Malware payload", "value": "f46c19cfcbc98ed41f6bd5ad7cac7bb8c1b78606e6e56e69442a85768c46852359f20873e43a7add6f9a49b7b1c8ebf6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137234, "uuid": "f98b2c62-a7fc-4f14-a463-ad78e8f0506d", "value": "A714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137234, "uuid": "3327de3a-9c62-44f8-8dba-b9cde2893213", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137234, "uuid": "58810d3d-b573-4e8a-8976-666e6680b652", "value": "3072:/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137234, "uuid": "8fce14f7-8fc8-41e8-b1d7-e4d790699ecf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137234, "uuid": "82c90d19-014e-4ee8-8da0-af71d88ac108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137234, "uuid": "04fb96d5-bba7-446d-bddb-f297488038dd", "value": "5dcec1a0b243300d7ba28438b7af8ec291ed73901a3859e01a6af7f1bf093347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69de000e-90ec-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617063062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617063062, "uuid": "59a4b0bf-e853-4f5e-b843-353f2e3edceb", "comment": "Malware payload (RedLineStealer)", "value": "f5d90ad0cfc9105b6a908ae02b0334d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617063062, "uuid": "c79c8c79-153e-4ae0-92c1-6cad68c439f8", "comment": "Malware payload (RedLineStealer)", "value": "5e18adfb9cd975a677c24f661b8bb3dbcfbe936e92c8c92f67d97e61eadba761", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617063062, "uuid": "4199971c-0033-4375-8541-e909ab8fece1", "comment": "Malware payload (RedLineStealer)", "value": "f301ec1bea5e4357eccfb47ccddcc73b08b72b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617063062, "uuid": "216a33c4-cf27-4ae9-825f-c5e8d1f12ae5", "comment": "Malware payload (RedLineStealer)", "value": "72c4ad0b5ddf7a9ace443821bfa5f4fbc6140a5e5d452be9422698c4ded34be44fc14649d75367487be5efb8851546bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617063062, "uuid": "a2908c8a-eee9-4ee7-84b5-2605da958732", "value": "4B4533A1B0406549C401A9788B1FCBBDEB463F0438E5607356D5BFCB793BB99EF06889", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617063062, "uuid": "4e79a923-8caf-4ae5-a87f-2e534bdc9429", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617063062, "uuid": "a16586cf-df24-450c-bd09-400c0f51e867", "value": "24576:XgbJzyWzWydf5gU4yHMuNVTRpGe3Jl6MqcO7NA+aJLyLALU0Jo:XiJzfz95gerdTkh5A7y0lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617063062, "uuid": "7e8dc2c6-897d-4dab-8bd8-541bdf7481fa", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617063062, "uuid": "e1d80f1d-58de-4a29-94e7-bc9d1ca48c56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617063062, "uuid": "99fbf161-016e-4054-9b70-8e87b112cedb", "value": "F5D90AD0CFC9105B6A908AE02B0334D7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ca7ff3-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "ff6785a6-a4bf-4325-8ee2-12b436987def", "comment": "Malware payload (Dridex)", "value": "d70a3c315b8fa85b647515a5ea13ba17", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "c38f567a-c52d-435c-bbf4-4724fad251ca", "comment": "Malware payload (Dridex)", "value": "5e5e9f983d27f92f1cc56b9450c823acf3ada5ff1b516eeaa96b06b191e89f33", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "0f3d1744-e2a2-410d-8df9-086977d12bf8", "comment": "Malware payload (Dridex)", "value": "c0d068ca7c951d5b85a55358ab65f859a3bde76d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "7d2b0158-89f9-424d-820a-888c37909cdd", "comment": "Malware payload (Dridex)", "value": "28628181882d74e82f8e7bc55b0be3e88ebe9029665e0e8a44386a75e6e4d12f0577e23f46332f0d857eeed4baf29e5b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "eb6d9e24-3391-44fb-bafa-20d15db2af48", "value": "1014BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "378a54bd-646f-472d-ba86-94787a320d6a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "7f490ab1-1c90-4436-b1c1-39e4de8e06be", "value": "3072:x3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:pJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115426, "uuid": "0f25781d-2d2c-4499-9a98-9a953d6ee07b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115426, "uuid": "918cd817-b176-49ba-9311-32d074edab1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "31685738-c0c3-4195-ae5d-b10bc2820781", "value": "5e5e9f983d27f92f1cc56b9450c823acf3ada5ff1b516eeaa96b06b191e89f33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc5e29b-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137348, "uuid": "4c726505-d6b0-4396-be44-d5986b3c1d02", "comment": "Malware payload", "value": "b6fa3374191a6d4332f5cec146e5f2de", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137348, "uuid": "3617f7f1-5bd9-480b-98da-8ed780cdb0b2", "comment": "Malware payload", "value": "5e7f1d8cbffe8593fbc689c57267c9f8af793645ce90fb6a1e55111ada1471ca", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137348, "uuid": "20a93922-8100-4a9f-8fae-b9eff750adc8", "comment": "Malware payload", "value": "cc7caa73f2b9ba5e0e1b2a156b7e6bd464f1b282", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137348, "uuid": "6be04508-1ffc-4c93-830b-42bfc0ddb63e", "comment": "Malware payload", "value": "80bf5b9c12ac5cc01588893dd28177cf19a818fa31e0f1d73fffdeebbee5b7bd9ed121add808039f99806df6483861c5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137348, "uuid": "f9901669-904a-4705-a6cd-71c106454f8f", "value": "FE14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137348, "uuid": "591cc97e-df6e-49a8-853d-0fa1fdc21fe3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137348, "uuid": "2d74ca74-a59d-4eb4-8619-bcd025345b29", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137348, "uuid": "ae200c0c-5624-4a53-b927-048fff21746d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137348, "uuid": "e162461c-917f-4661-bfa0-08c06ac53304", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137348, "uuid": "a0a3d7b9-e7bb-4b12-a42d-e3fcb62f7a6f", "value": "5e7f1d8cbffe8593fbc689c57267c9f8af793645ce90fb6a1e55111ada1471ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b82e8df-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137368, "uuid": "b9b64da4-001f-4a22-9612-37c6d6527ea5", "comment": "Malware payload", "value": "aaa4525a6292e128bdd93724c9f9ed22", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137368, "uuid": "2d15dd37-2cd9-4628-9a74-d12c1d2a7893", "comment": "Malware payload", "value": "605cfebb3c2c929b8cb1ed629e4bff6d753fa0942382d94ffb372691cf6c43f8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137368, "uuid": "42245643-e524-4d56-b298-84b4e09bdb22", "comment": "Malware payload", "value": "34753508c14fad247e18599e011400c8367c84e0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137368, "uuid": "27c79e96-4dc7-4515-80ab-738e30145f08", "comment": "Malware payload", "value": "432eab4501581d72077fea6f6517613d631bcb048e38ec0b5b64535a071099d4167eccba7e167a22ca70d41dfce40114", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137368, "uuid": "f82f54a5-3171-480f-8461-2b0ec8ead7b8", "value": "D814BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137368, "uuid": "766a2a1d-450c-467a-b883-c851c12e4f9d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137368, "uuid": "a6a2b177-2d1d-458e-8325-1fac19fe8de3", "value": "3072:x3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:pJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137368, "uuid": "4346cc8b-4c3b-41ce-97b4-144ca26e8423", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137368, "uuid": "748a2aaa-daad-48f7-903f-4202081c9bbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137368, "uuid": "59a06281-4aad-48af-8f11-02e425916399", "value": "605cfebb3c2c929b8cb1ed629e4bff6d753fa0942382d94ffb372691cf6c43f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c369124a-9158-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617109598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109598, "uuid": "b7267294-a47f-4719-bb9a-b763b00ac328", "comment": "Malware payload (Formbook)", "value": "79bbc760566edb6a69a9d9e05f769746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109598, "uuid": "47bbb5af-fd4b-4ae9-8381-2dabe9b1d906", "comment": "Malware payload (Formbook)", "value": "6071e97eb6bbb48aea3c96d06190166daf16ecff8dcbc0481cf44e2c8ef84a30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109598, "uuid": "e1ff4a0a-c581-4d22-974a-6fd009074e65", "comment": "Malware payload (Formbook)", "value": "3e6a6b081f4b1f5094c543da0c069e8bd46f5146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109598, "uuid": "f4dd57f2-4b1e-4bd0-bc3a-5822662dcc14", "comment": "Malware payload (Formbook)", "value": "82bf0bbaf2170c95b10434e1e773af47e2c0c9ff726c060ac28f128aa2d9e96d8da4041fccde638b883e8e500445b5c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109598, "uuid": "587f3897-a75a-4fbb-97dd-0cbb10e023c9", "value": "8E24121B62F5883BEE10667055F6EF36EAF7A241163716475B301F39272068BC72728E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109598, "uuid": "235cca1d-4caf-4980-ba88-79eb3611923f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109598, "uuid": "ff2f6988-6b19-4ebb-9dbb-98e813d82418", "value": "6144:nAPco0qGufG90hUvSt3i2MqCFtzi71p7ybT9CNb34nu6c:f52rhtbDCFpi3y9m8nu6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109598, "uuid": "1f58c1f1-6382-48b3-804a-c2f48e031c1f", "value": 229959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109598, "uuid": "c8607cbe-3f08-4680-a54e-1ac48695014e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109598, "uuid": "2127a009-a7fd-4b45-91a3-9a4265ce8102", "value": "79bbc760566edb6a69a9d9e05f769746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe28024-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617085648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085648, "uuid": "9b48fc99-5579-4299-82a2-a7dca831ad13", "comment": "Malware payload", "value": "91e462491bc750e8f64c92a91afb88ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085648, "uuid": "504c6686-ab1c-416d-ac2f-07bcfaf8f349", "comment": "Malware payload", "value": "609aa18f8033b266001d86ce69104f81ce0d520df8e1718277bdf2479acb11e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085648, "uuid": "485d369a-9910-4677-90a6-42fb795f5c51", "comment": "Malware payload", "value": "48321afd723848dd15a55003f4a48be62cb1fd6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085648, "uuid": "1dcbc7b3-0019-4b9d-b359-ee8484e6264b", "comment": "Malware payload", "value": "0a90733a945d9aec6a657c92730e250a82c8b1180018f666840fdb93e966a0415aa64a446a9a91f8012db57cbf80ff4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085648, "uuid": "dfc75732-8124-424c-b503-b86f41ab9492", "value": "F67533AF1053256ED040AEB100569E35BBB7A81D87D6A9D337F00BAB1C025E5FB2F1C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085648, "uuid": "d3b59097-9d72-47e4-8086-459099e46078", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085648, "uuid": "773f5d2e-bba8-4507-92de-522012410c8a", "value": "49152:yog9HikVuDvTJXH9IF4Sej3qGhkasyq4dKVFMz:FgHQTVVSm6qO7Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085648, "uuid": "531a87e0-079e-4c06-bb4e-78fbea49d6b3", "value": 1641424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085648, "uuid": "6cd17bbd-985a-459b-84ab-f9abfc0d39af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085648, "uuid": "581fe598-9cb3-487f-afc9-a7d8c79efff0", "value": "quotation5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dba1cff-9150-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617105911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105911, "uuid": "51877df0-964c-4447-b08b-9ac19b7df4f2", "comment": "Malware payload", "value": "b35918ab7dd7b7582fd45ee3144baff4", "object_relation": "md5", "Tag": [ { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105911, "uuid": "1bbc21eb-9c4a-4047-b4c9-89e03063ac1d", "comment": "Malware payload", "value": "60d6733c1940b62f13cfe42d34c0c43aa73f3b8822d8c21cad5d3ebd6b9f94e2", "object_relation": "sha256", "Tag": [ { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105911, "uuid": "dd092473-2ab4-4e1e-a049-023064c96dd0", "comment": "Malware payload", "value": "ac79ba5fd6618edf16c5c3e5d4f91576f7dbbb1a", "object_relation": "sha1", "Tag": [ { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105911, "uuid": "144940fb-ed3f-482d-9d68-db2c32fd9b8e", "comment": "Malware payload", "value": "2e51b01040171ca357cff31dd10391304bc59617a2222cc654cb4ef339ca146d955c4e633edc232773c4665886dd9d32", "object_relation": "sha3-384", "Tag": [ { "name": "Evader", "colour": "#9B34AC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105911, "uuid": "bcf11c67-9240-457d-9c08-bbbd269613df", "value": "E0C45C06E243A2F7D82705B0128BF7BF4630F63584529DC6B7949E5AB9338F26A4D353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105911, "uuid": "61957fe6-c200-48aa-8541-e9b3fd53dd3c", "value": "12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmx:VIv/qiVNHNDEfJKHZ8mG9QeeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105911, "uuid": "94d72498-85e9-47b3-9f0b-437dc19f63e5", "value": 562240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105911, "uuid": "84fa6162-07e0-4383-8ba5-f4fa6090410a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105911, "uuid": "ce9b1123-8ac6-4234-ade6-67183a4b0092", "value": "60d6733c1940b62f13cfe42d34c0c43aa73f3b8822d8c21cad5d3ebd6b9f94e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d679fd92-91a3-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617141842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141842, "uuid": "ac1c54e8-9583-44d1-ba4f-22e9ec2f0648", "comment": "Malware payload", "value": "f441971449d4875e73a3dbb3a03885de", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141842, "uuid": "9b05a9c5-8ba0-4ae1-b799-b70f7950adde", "comment": "Malware payload", "value": "60f9b9bf5a3ac9c3a085f00416bd6803d49a461af3df9ed6db136654da7d642e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141842, "uuid": "3d1cade9-7c9d-4f89-920f-a327fdbeb615", "comment": "Malware payload", "value": "1533518a96ac86e3cea2c374a3307b56856984d9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617141842, "uuid": "a3a832c5-2de3-4343-8678-c44496d170c7", "comment": "Malware payload", "value": "884ea37ab71c7ca9c2e5d29f26fcd30045bf543618196ca4da1cf4c853abd238e2912e461937415cfca68d320d9d49a3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141842, "uuid": "7a6b13bf-f909-4d37-942f-117c79c3a4df", "value": "4F14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141842, "uuid": "ca175e6b-d989-40e8-9399-cd3576c7be29", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141842, "uuid": "9be618a1-a0b9-48bf-a8db-389aeea42a72", "value": "3072:M3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:oJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617141842, "uuid": "17810feb-09cc-4ee3-8472-eca964de81f8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617141842, "uuid": "ee691903-2b11-486a-a18d-74a8494572ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617141842, "uuid": "27e3ff49-daa0-4209-bf57-6f38a94fd851", "value": "60f9b9bf5a3ac9c3a085f00416bd6803d49a461af3df9ed6db136654da7d642e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ce7656-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114114, "uuid": "19cef539-b048-47b0-ba19-e38f51191480", "comment": "Malware payload (Dridex)", "value": "f370d652347b9440196dfc1879e24b87", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114114, "uuid": "9b658849-9321-4622-837b-edacbed796bf", "comment": "Malware payload (Dridex)", "value": "6104bc92a937f283e2d67e928ea91b644372eb7ed0b183134a747cd3d9e87730", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114114, "uuid": "1313252f-4c28-49ce-bc52-eece4f818a85", "comment": "Malware payload (Dridex)", "value": "cffb0820152fa14cef63542ce6ca9e8bea2edfca", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114114, "uuid": "a6956f6b-e364-480b-95d7-b419edd4cf96", "comment": "Malware payload (Dridex)", "value": "07e4f33a896214c9dabe0a5a7904f3c91e3c93fa65556a26b6c425310810bf8e28cff4a70e993f964685817d700d3dd9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114114, "uuid": "d603f313-8ca6-4e00-8411-1f1eb2a314c4", "value": "F114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114114, "uuid": "36350bb4-28c8-4f61-ad79-1a50dce0967b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114114, "uuid": "57268a50-5ced-41b9-b487-4ad46e1a06b6", "value": "3072:x3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:pJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114114, "uuid": "c1049840-c7ba-4847-aa0c-692d94c01c83", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114114, "uuid": "c6c3e95b-6da1-4dce-851e-67de7fdc3cd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114114, "uuid": "01899b91-b9bd-41e4-9252-00e80fd00d96", "value": "6104bc92a937f283e2d67e928ea91b644372eb7ed0b183134a747cd3d9e87730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e81539-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "5d1ddd4f-63c8-4d4d-bb4c-0de2cbe85e8a", "comment": "Malware payload (Dridex)", "value": "c35ad5af79b034728b911ed8f6499b74", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "e3585f39-c604-4e8f-8f1b-98f4ccdcb8f5", "comment": "Malware payload (Dridex)", "value": "62208ff7735fc9c17c41920a370d786a3a905e7b0e5bd2360eb683252344da30", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "4bfc2aa4-646d-49cb-b521-ab1037f19068", "comment": "Malware payload (Dridex)", "value": "44ad42c93d145a1a009dd6d912fa11aeaf48585f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114079, "uuid": "b3d62449-0340-44ea-bce6-1e7cb7ec98be", "comment": "Malware payload (Dridex)", "value": "11424c48b4102c421ca3307944736fc4714afb56dd9762ad9f023d32b99dc4c84ade814da6870d651965c5c797e9e806", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "cde623e2-9166-43d7-932b-f48c6d3a4381", "value": "2114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "9f3d9577-03b3-444f-a027-a377b78afe58", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "5e9db632-c523-47f9-a856-2e7e400be7a9", "value": "3072:73PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:bJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114079, "uuid": "a1a1c856-74c1-42b8-a00b-53915b018889", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114079, "uuid": "d957a38b-9b48-4d3c-a064-17eb8d4ac1cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114079, "uuid": "73eb55f2-f35b-4aa5-a0dd-b29e0f0897f3", "value": "62208ff7735fc9c17c41920a370d786a3a905e7b0e5bd2360eb683252344da30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf102935-9185-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617128918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128918, "uuid": "f3ba3c0e-1a73-4cec-be11-5ff3a07aad43", "comment": "Malware payload (IcedID)", "value": "29b9c212cc5e175e84b62f6ba8da2d12", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128918, "uuid": "1e93e7a9-5a38-42c0-8a6b-f4bdaac9a24f", "comment": "Malware payload (IcedID)", "value": "625e49f970a36dc348202fd224401a8c454e076e743f893eed0099b0e13506e0", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128918, "uuid": "482322cb-d337-484b-b583-98abaf873d35", "comment": "Malware payload (IcedID)", "value": "9f6c13f606e316e99ad0ca79a3f5b017da28d08b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128918, "uuid": "0fd81a83-e6ba-4b54-86b9-80d5f6f5be99", "comment": "Malware payload (IcedID)", "value": "d4978026d0929d7b6cd5e67e6247b3451d532b7bf2df15707f69b021afb16553ea054fade76d36bb9e7829950d88c255", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128918, "uuid": "0e64b0d5-6664-462b-bc8c-3cf59000c61e", "value": "9BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128918, "uuid": "1de9c1f5-1f1e-4148-bdf0-a86e8d091f9b", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128918, "uuid": "ccbbf1fc-9c38-480a-9361-fea703a6408f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128918, "uuid": "36569ad2-3f4a-4d37-a453-da68fa11fc54", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128918, "uuid": "f631e0e2-4761-46fe-b822-3b6029ca0c55", "value": "document-87843570.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5496b4e-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617085496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085496, "uuid": "9556d0ab-51a6-46a1-80f8-dc0d5b995de1", "comment": "Malware payload (Formbook)", "value": "b8fd7578234f669cf73f76757103ec25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085496, "uuid": "fcf8b7a1-1c58-458a-a070-51aaa7c7889d", "comment": "Malware payload (Formbook)", "value": "63de541c62f4f502b608e9978738327a880f9890aa980e4f6c070f87d33641e3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085496, "uuid": "4b780432-292a-4aca-b728-fec401e4492b", "comment": "Malware payload (Formbook)", "value": "482709e052233323ff6ad80b0342caefe7392593", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085496, "uuid": "ac4abc90-2151-499e-b878-6a8a39c85398", "comment": "Malware payload (Formbook)", "value": "f81079edf3d9966495a67ab95747a90881b2209cc1e15680751a48706e9ded136bf877c599b4845b50a21cd887554976", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085496, "uuid": "29a222d2-74b1-49a1-9317-ea3356a10f1b", "value": "3B450226B2F58877EA6903B006F77B6AF3F9F646335166133B6C0E5C2B20542EA105DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085496, "uuid": "f172df9f-10c5-403a-87b7-928790704c34", "value": "6144:IAPIpHmX3gQEoaXLa172nOLVZFfjUHh6:PX39G7A7LVZqHh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085496, "uuid": "c0a3b217-33db-4470-b355-257244619c6f", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085496, "uuid": "0d44c7ce-f28a-4345-bf5e-8da8173c8b24", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085496, "uuid": "3b85036d-17b9-42e3-8e40-8554d8d07987", "value": "Swift001.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b5fc24-915d-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617111749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111749, "uuid": "e32225c0-a431-4f46-aee4-617c7546f92e", "comment": "Malware payload (SnakeKeylogger)", "value": "285bd916cad29d29a1fea05ba8ec0176", "object_relation": "md5", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111749, "uuid": "97a175ec-d46c-454e-800d-c7ba91a5b670", "comment": "Malware payload (SnakeKeylogger)", "value": "63f0d48d3bca2c814e31e53522b70683e9f2f4ff5b75acf6785be4ef333859a0", "object_relation": "sha256", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111749, "uuid": "fee495e6-3249-4eeb-a333-156bf81497f6", "comment": "Malware payload (SnakeKeylogger)", "value": "d56ab9ad16ebc008ebf9fad2b688bfd297f8a6d6", "object_relation": "sha1", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617111749, "uuid": "ddf92942-1edf-4b87-9392-f984bb8f8fc2", "comment": "Malware payload (SnakeKeylogger)", "value": "0039d75881b3baae33d462008656d215c1cc821812938695868f49ca5260679e3f9991a66ea5206d1ca28ffaf7d14826", "object_relation": "sha3-384", "Tag": [ { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111749, "uuid": "ad130579-ef0b-4007-b966-687d8a2f1126", "value": "29A4232C28C59B4B0F1604AD1BF217FF25E0A1A1709F68A376DF0F61E63EBF21225519", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111749, "uuid": "71301998-9cc5-4bfd-8ad7-25259d877f12", "value": "12288:YHjwjcgohYhIVckPc3CcqI8HTwgFz3Ygag+9I7rQLhMb:YHjeahSccScqIIygag+rtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617111749, "uuid": "209ca744-df1b-4730-8791-b8707da8bd73", "value": 480330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617111749, "uuid": "1eb7ab7d-7e1f-45bd-89b5-c4709615f839", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617111749, "uuid": "dc970afa-3ca2-4b97-8f4b-de4295edf9a8", "value": "QAUTATION OM OF SUPPLY.R13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f6a4e4-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617083052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083052, "uuid": "d0ade504-c639-4cfa-8ed4-c7d22cffa511", "comment": "Malware payload (AgentTesla)", "value": "3876ba48d6616f228c3388ccb553edb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083052, "uuid": "5443bcd8-7620-4fd4-b452-e0f0c336d81c", "comment": "Malware payload (AgentTesla)", "value": "643e36b60c2cec5bdbf4fe76ac0190131856d78a17fbc0823fe672607c2f5f64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083052, "uuid": "a7f58178-0ca0-4254-87c4-5796c954b7d6", "comment": "Malware payload (AgentTesla)", "value": "9cdad321d57a9f7e08c70bd93866b0be6d51ae27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083052, "uuid": "0468d99e-5e3b-4b94-a1a8-23142f134c75", "comment": "Malware payload (AgentTesla)", "value": "12d39fd90031b954c940fdc0f70f8a786bdd7f4306345b5a6b50d2f94a8fab00c53b589d1736aeb05eaf56f24480aefb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083052, "uuid": "340574f8-5f2b-42d1-80b6-31dd37016fd8", "value": "F39423BD8095BF8D934F6190D27991AE1CD1073BD091B1B9189AE375C9E32F8BB341C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083052, "uuid": "dd8c2ab3-81d2-4ded-80de-583df0c154ed", "value": "12288:SDx9nhFFXSvtdPR39ZbTQM5Ymo+Om7KNv:Ix9hTXG3D9zKNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617083052, "uuid": "bdc9b013-a47b-45a5-91ae-e09d973d935c", "value": 441502, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617083052, "uuid": "008872b0-bb31-4d08-8290-6cba2727f196", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083052, "uuid": "fcb78695-4d69-4e01-aa40-2ef3b924f461", "value": "CI-210318L.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f572c8-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120883, "uuid": "18520b2d-6410-4c40-84d9-94be94ca3889", "comment": "Malware payload (Dridex)", "value": "59935814c7d376f36efe27e3a54494dd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120883, "uuid": "3eff2b89-6ff0-44b6-adae-68c46086d6e7", "comment": "Malware payload (Dridex)", "value": "64b6090d3d5e3a0083026cafc1c2215c021c62f48ef3576b30b7af5451049c2a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120883, "uuid": "12face91-a3ed-40fa-88f9-8f52957c7796", "comment": "Malware payload (Dridex)", "value": "7706770bd8265c8b5ef3d7e4a5341fda8132c69a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120883, "uuid": "382167d0-ede0-42d1-8711-52c6a99be2ca", "comment": "Malware payload (Dridex)", "value": "778f1fe1cf9048a4f4619322e6006be19c25afd344f2263b9dfc78a43f1d33ac8ce3f02f7208e2e88540e882de4b0a47", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120883, "uuid": "121c601d-341c-4d78-a3e0-137bec596ee5", "value": "2B14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120883, "uuid": "7dde039a-c5a0-4675-a4c4-6bd0575c7a83", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120883, "uuid": "6dd1e378-4806-4f1d-86cb-ab05923f70b8", "value": "3072:Z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:RJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120883, "uuid": "0d76f736-bd91-42d9-898c-6d831dc81b56", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120883, "uuid": "7f1e33de-1f03-418d-8dde-7e160f466ff5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120883, "uuid": "11c9f3e9-00da-4fde-ab90-4f12b9d2eb98", "value": "64b6090d3d5e3a0083026cafc1c2215c021c62f48ef3576b30b7af5451049c2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df616b46-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "9cbf9d4f-5d83-424c-90ec-a3a6e55685d5", "comment": "Malware payload (Dridex)", "value": "3f5580d8ee7cc2d24da1abb61c82587b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "adf933dc-2184-4da1-b002-51508a2d910b", "comment": "Malware payload (Dridex)", "value": "64dcd2523d97ace50d2a6438e99102f65041d0fa53513d3d684214ca0c840dee", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "72036f14-abb5-4e3e-817b-02eeac1e8876", "comment": "Malware payload (Dridex)", "value": "86bea2031494e488e9604280787cf3f50ebc9628", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "348f8994-bbab-4e3e-847b-0712451d274a", "comment": "Malware payload (Dridex)", "value": "6f37b1dbc6361360d6599b4db8e9a68c6b83e8991d0103f9161c37d6862e9cc90cfff74341eccec1b4e31b336a54e71b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "3f57fe49-2960-4233-b461-1ae83589f3a1", "value": "1114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "d9eb47fc-3f88-47ca-8d86-cefce24c503a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "4f1c7722-1184-44a9-a612-fb35926b8b85", "value": "3072:53PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:xJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115229, "uuid": "fcbd400b-2320-4828-a6f6-37d82eec34ce", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115229, "uuid": "73c30a25-62aa-46d5-909a-69e5f2f888e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "ed3fe06d-3d22-48b2-b862-1f991b4aef8b", "value": "64dcd2523d97ace50d2a6438e99102f65041d0fa53513d3d684214ca0c840dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2ab88f-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121453, "uuid": "8687661a-6a72-4b50-b494-25d0808b6fc3", "comment": "Malware payload (Dridex)", "value": "b565cd58cd37793b470286ffc5616099", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121453, "uuid": "c6fc4b7e-df2d-48d2-be00-c0c08b92fbe0", "comment": "Malware payload (Dridex)", "value": "653b5ec453cd7102d3109a860aadad73d874d68a2fad632b5a889df1f9f54fea", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121453, "uuid": "67eea1c2-d588-4174-9ff5-906eded6574e", "comment": "Malware payload (Dridex)", "value": "90f1b135b3a27ebc0f6da89782bc4973f62ef559", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121453, "uuid": "9edb152c-af7b-4164-98d7-1d591ba08538", "comment": "Malware payload (Dridex)", "value": "200d0ed181531e996bcc4d601c0eb1b4f822d291369b35f838a924b4f0a81a7d199d7b33f8630174a7e6c165cb044795", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121453, "uuid": "e6f8823e-2bd0-479c-8290-7473718553b1", "value": "E814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121453, "uuid": "2a24fbba-76aa-48b8-bbfe-6463dd97d16c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121453, "uuid": "a9b6d2dc-3f05-4772-8c87-09a0404aac9e", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121453, "uuid": "a243d69b-0ab4-4179-8416-b38af9153083", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121453, "uuid": "14b218f4-ab23-4340-82bd-d47bbf436189", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121453, "uuid": "17042fe7-3eb3-448a-8f8c-92b404c8b11b", "value": "653b5ec453cd7102d3109a860aadad73d874d68a2fad632b5a889df1f9f54fea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3e41eb-918e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132697, "uuid": "9038aff1-75c1-4e2e-bfa1-ceddaf937375", "comment": "Malware payload", "value": "65f59eb4ca45ab55341865c618ec7c24", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132697, "uuid": "e6582ad3-db8d-49ec-a83b-293bce036093", "comment": "Malware payload", "value": "65c9d2f1d2b85af6a855c59952435a2db271f64b2e6aeaf47b39fe46b2ebfea5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132697, "uuid": "728546fa-3e0a-4e17-bf7b-2e54dbbc88d5", "comment": "Malware payload", "value": "18e3c4513288f4af2a1a3ce020c29b988148e358", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132697, "uuid": "9d9c72b9-6b5a-4c2b-94f9-dbc689dc8b15", "comment": "Malware payload", "value": "174706eea1fcee7f7525ace9b4f3726ca7c232917e5f98618d0f6ee3e99ad295f3d51eb69fbabcb287ebf5613017c6b2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132697, "uuid": "ad0bd34f-e926-4fa9-8210-5f27f09a9127", "value": "9A14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132697, "uuid": "05ba09ad-e255-4709-95d0-65fec0419e83", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132697, "uuid": "e6df455b-6472-4d8f-9587-c64109b9977b", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132697, "uuid": "dcafeaa5-0ca5-4b23-9f1c-542c7349ee00", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132697, "uuid": "713c1c4c-ba4d-42c2-9089-7c405ce76d1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132697, "uuid": "76043f82-ce82-4afd-9d34-59e058227de2", "value": "65c9d2f1d2b85af6a855c59952435a2db271f64b2e6aeaf47b39fe46b2ebfea5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1f624c-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115544, "uuid": "f9751c8e-9a80-4c42-81e2-511c02f23587", "comment": "Malware payload (Dridex)", "value": "b8c09f2af241455358bc441204b3b9a6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115544, "uuid": "7e5e821d-3006-48dc-8f36-af5ee7984c4b", "comment": "Malware payload (Dridex)", "value": "65e65b5b9bb33c4783dce31e59272fe245d11cc9b58311aeddf0e5691b08a6f1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115544, "uuid": "47901e39-cc68-4df5-8e11-23a14fd3d4d9", "comment": "Malware payload (Dridex)", "value": "80b941462717f99f9e01bfaaf19365aaf7d077b3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115544, "uuid": "05c06fab-dbe4-44d9-9673-05e5ddc8441c", "comment": "Malware payload (Dridex)", "value": "8caf0bdfce18e25416ddef0f87934907ac016aff2748676fbdb965519c21b78a7fe56771ab4b46619ee0aff15afc9185", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115544, "uuid": "6130c1a0-d90e-4fb6-ba5f-6853034c1dfa", "value": "3E14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115544, "uuid": "c37c8cc0-9605-4782-93a6-da5165f83310", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115544, "uuid": "dfc9f222-2cd8-4b52-8bf7-458ebb66b72d", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115544, "uuid": "4d9bce4e-1e98-41e1-9daf-a635bbb8bab3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115544, "uuid": "6082d64f-e4f3-431a-b223-6f0bc8a425fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115544, "uuid": "3c0bdc5e-b77d-4328-90c7-00bf917230f4", "value": "65e65b5b9bb33c4783dce31e59272fe245d11cc9b58311aeddf0e5691b08a6f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a404476a-916d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118565, "uuid": "249902b3-da6e-4e14-9ae6-b24e98fe5470", "comment": "Malware payload (IcedID)", "value": "7c2761b0a5ab697a0f0f1757b4a55ac7", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118565, "uuid": "941c421a-fcb4-4799-b690-ce4160e90037", "comment": "Malware payload (IcedID)", "value": "6604fda7126a47a18fc9234806f08c59f6421277457680ab504f4075f2cd73e4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118565, "uuid": "216e7b85-296f-4ded-829a-2554a624490f", "comment": "Malware payload (IcedID)", "value": "9bcb729a316a6fe33d6a9a9f9262fce92305bb3f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118565, "uuid": "7bb02be8-0db3-493a-9550-bb57bd9209dd", "comment": "Malware payload (IcedID)", "value": "bc386653bf14e4301c900d14f11e7ef9698ed6bbb19dd9d5608579a450576ff069ef40fa77cc281f7cc02c675fe6b008", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118565, "uuid": "e5cb6cdb-0763-4651-bee2-61c4b5bccb25", "value": "67B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118565, "uuid": "59d367a6-a909-452b-98d3-ecc25da6466d", "value": "3072:+2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:+zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118565, "uuid": "bf9eace3-7f1d-4615-b8d9-9836758e97c4", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118565, "uuid": "eab9edf2-7592-4386-968c-a0bf7fdb5b11", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118565, "uuid": "f111611d-6f39-46f6-ab15-09ff8576e375", "value": "document-1415732040.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c987d-9195-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135685, "uuid": "1eb88063-a83e-4e3e-b08c-14e9aac6b41b", "comment": "Malware payload", "value": "e48441b6231f6d2a870e494ab7002de4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135685, "uuid": "ee004abf-c2b8-4f2a-8c8a-2e7cc9f5cfe9", "comment": "Malware payload", "value": "661b5917c92f02e553b7de697dd970bc1e3af4927e8ee0d47b2763c8401a2c77", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135685, "uuid": "d95c6a47-a3fa-470f-842e-46235df2f9be", "comment": "Malware payload", "value": "64ac03686672c7803beebadd63ed8f13fdb0107f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135685, "uuid": "1606f4ed-abfd-4591-96bc-edf5303cdc53", "comment": "Malware payload", "value": "84469ff39487150bd6ca022d6be31a760056f127e981e5cad243284d16809dfd8ab860a93cfa17421d70676d36074afd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135685, "uuid": "34c544d7-5fa1-4013-8563-068e72cc534e", "value": "D114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135685, "uuid": "35a13920-9871-425a-a67c-3fab39d833b3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135685, "uuid": "1be48b59-20bd-46b1-9a3a-08d5bd34a579", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135685, "uuid": "a9b19f66-3091-443c-98f0-b3a74b0668b8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135685, "uuid": "ae9477c3-57f0-40cd-9956-4f14ad23c9d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135685, "uuid": "be725c56-bd8a-4f5c-8d95-f3bc09943424", "value": "661b5917c92f02e553b7de697dd970bc1e3af4927e8ee0d47b2763c8401a2c77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d92c8-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121818, "uuid": "0ffef275-7995-414c-8fbb-9f6af3bfdef4", "comment": "Malware payload (Dridex)", "value": "8ecb1711f02e686379218ebf91fe7c50", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121818, "uuid": "fec8e32f-efea-4446-9da2-9fbc523f0289", "comment": "Malware payload (Dridex)", "value": "6640cb43ff766639f336042249d1844b8a182c7805fd83b1bfccba72e2de98af", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121818, "uuid": "8b584897-60c1-4420-a94b-8705c5be4800", "comment": "Malware payload (Dridex)", "value": "04c9ee5defbd6e4f033c52580d03040fc37652aa", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121818, "uuid": "c31c105f-12d3-4999-85fb-e1004b582fe5", "comment": "Malware payload (Dridex)", "value": "d237274aba4fcff0f8be701a17068673825add4245e5f7c8724d4e0a9455443d28dbd8d43ce8f6d6964753c492a395f5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121818, "uuid": "e57a26b5-b9fc-422e-b40b-8db822be13ae", "value": "2314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121818, "uuid": "c41f1660-b10d-44ca-8e61-f8da14addc99", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121818, "uuid": "c929832c-d8a2-4539-b024-a53175c18d1b", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121818, "uuid": "22a07345-2239-4a36-8c91-7cbf0d4becd1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121818, "uuid": "bbfe3f0c-77bc-4ad5-9e49-15d413492db8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121818, "uuid": "7a268cf6-994e-4084-8e72-d4e1c1dfcb43", "value": "6640cb43ff766639f336042249d1844b8a182c7805fd83b1bfccba72e2de98af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0b8a8d-90f9-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617068678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617068678, "uuid": "a669872b-00bc-4ae7-8354-5375520467c3", "comment": "Malware payload (IcedID)", "value": "8fbfe82789fde7864a02bd1491e8abd3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617068678, "uuid": "01ea14ca-7145-4e0f-ae69-33ba8f01be24", "comment": "Malware payload (IcedID)", "value": "665c112f5e110408958138c613d7d1340d8bfa87385f2df1ab30d36923fdf15b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617068678, "uuid": "3ca2d8fa-b19f-4a39-8c76-ce6e7e397f37", "comment": "Malware payload (IcedID)", "value": "721d1b4af7175fe6174bfb78c67f7aaa10143714", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617068678, "uuid": "5b6add6c-e4f7-4922-bfaf-2e5348fe7fb8", "comment": "Malware payload (IcedID)", "value": "8be0d507e00229e5627b06afbcb85792c274af29dadb7201d388bf0d450dbd043f883d76c2adb7a67b888e02a2451fe6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617068678, "uuid": "e44bdbe6-0189-4800-95d4-17bc6f7a86fc", "value": "58A4F71AD6380BBDC512E879C517A433E1713C2502E889BB92E467776F32768FD6E720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617068678, "uuid": "eb7016ee-6df1-4d71-a5b5-237f7b1bdd37", "value": "896f4618011fc8c614eb9c9053bf51a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617068678, "uuid": "dd77b05e-b09b-4055-8187-5bdb5472f0aa", "value": "6144:7uvnWwlxWgg8x/V/f1VK2+3uGWppAPFXYcaUohGtfJTzYJwa:7u5g8x5K2+R4APGRUoOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617068678, "uuid": "0bbded37-6cbe-46f2-a5ed-cb07eeb2b07c", "value": 483757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617068678, "uuid": "7ebfd12d-a15e-4b1e-bf2a-510c937b123b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617068678, "uuid": "5e3c5495-eabd-4a91-a017-47bfd134a1a2", "value": "665c112f5e110408958138c613d7d1340d8bfa87385f2df1ab30d36923fdf15b_2803.gif_IcedID_detected", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5541a6e-916d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118567, "uuid": "bae0e5c8-a4aa-46e1-a741-a5aa189d36a6", "comment": "Malware payload (IcedID)", "value": "b1cbca66f1371d6d502d044dc65b5deb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118567, "uuid": "78aafb8f-ab21-46a6-a5d5-af38495063e8", "comment": "Malware payload (IcedID)", "value": "66721ff114fd05a9391d215a5937eed114f0974c7b3de5bf16791b7fc6b7433d", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118567, "uuid": "7a6ddf19-2d78-46bb-9276-4f8044c5509c", "comment": "Malware payload (IcedID)", "value": "769721e818e2810124c21105987e08a5d67e5b4b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118567, "uuid": "e6e61c1d-b4cb-4689-9000-d0ec6dbd3fd1", "comment": "Malware payload (IcedID)", "value": "35b0a712feb611d242609527bcb8e849b751d3369f9af1b2de8e964aea59b4c2b8ecc4bbb1586e2588887f1c14267ea5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118567, "uuid": "fff339eb-bd45-42d4-839d-e907a0b6361e", "value": "96B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118567, "uuid": "3e7c208a-238e-49ae-a952-986ee2265ffd", "value": "3072:c2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:czxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118567, "uuid": "7f27815b-0151-49d1-9993-017cbb548873", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118567, "uuid": "b3f9909a-4395-4585-a077-33f95128094e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118567, "uuid": "d8c94ccb-5919-42c6-b92c-e5f0d15115f7", "value": "document-1384256667.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f45827-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137142, "uuid": "623a8b89-4597-4583-ab28-69b2c607fabf", "comment": "Malware payload", "value": "4d767237cc9ab62fe98736c81bec622c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137142, "uuid": "008cda4e-a419-4444-b733-8e66a6ac4abf", "comment": "Malware payload", "value": "672feca78befa015e4a41d4d40356868f09318bb5509e1af81abd275dd4c2ba0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137142, "uuid": "b5cecaa7-c91e-4b3d-abe9-6510521a0d05", "comment": "Malware payload", "value": "686552461847873be87829c261f6d1f20e16b232", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137142, "uuid": "a45958a6-1856-451e-8796-345215f359a8", "comment": "Malware payload", "value": "87da8c27c391cda5c45d79910a2a1777ce6f565187a54bce8485b67614efebe4ce793a223bbbf3759198ad42472d7b12", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137142, "uuid": "ebfbcd63-d890-443d-9831-c9ad3ed57714", "value": "BF14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137142, "uuid": "6406642e-5d98-4c1d-8d61-2b58299f13a3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137142, "uuid": "47743965-a27b-4245-9b8f-6f5b65c5abd2", "value": "3072:d3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:dJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137142, "uuid": "663ce9f7-906c-4cc1-862c-b2d999109e9f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137142, "uuid": "fc1d7e45-e241-43c6-bb24-763a409dc0f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137142, "uuid": "bb433123-c399-4e03-949d-8d8748dde515", "value": "672feca78befa015e4a41d4d40356868f09318bb5509e1af81abd275dd4c2ba0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577c383e-9179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123590, "uuid": "a382ac53-b5a5-43e7-afe5-027ace1d7ac1", "comment": "Malware payload (Dridex)", "value": "87f408c42aacac4ce681cfb4ed78594e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123590, "uuid": "ac4019a0-e50c-4a0f-8ad2-0c261640abb6", "comment": "Malware payload (Dridex)", "value": "6742706f7423f4030dc46badf4274485b3feb737278026a93bf6965e98cf6b80", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123590, "uuid": "3bb824a0-dbb7-4dfa-9d77-deabc293cbbe", "comment": "Malware payload (Dridex)", "value": "016835c05a7cce1dee4a4a12a29745963c84c6e4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123590, "uuid": "ded25609-0306-4ec0-a17c-1024a1624265", "comment": "Malware payload (Dridex)", "value": "a7be0e565551824f1cfb76c18613b01adf7dbf5b37396b53b09ccbd23b81ba1a84e40900f3f176cd75da3e20e9a3522b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123590, "uuid": "6d2f80c6-b343-4264-b760-5726dc051453", "value": "CA14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123590, "uuid": "524175a2-ed6e-42e1-87cd-6af6130b1ab1", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123590, "uuid": "be316f35-a732-4221-b126-49394e6b99e8", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123590, "uuid": "c6c2b8bf-349c-44b2-8507-8607f89a0951", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123590, "uuid": "655bcaa8-d533-4167-8e74-5849c16400fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123590, "uuid": "1a5bf788-8d73-431a-a1c9-a30379fc40d1", "value": "6742706f7423f4030dc46badf4274485b3feb737278026a93bf6965e98cf6b80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f858b9df-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114411, "uuid": "5456c268-addc-40e7-9b12-1bd8971bedd9", "comment": "Malware payload (Dridex)", "value": "236a8c827f12c5e9f06168cc4b1afff1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114411, "uuid": "1a1abe7a-8ad0-47bf-8c05-0a8863b4f081", "comment": "Malware payload (Dridex)", "value": "67455fee28a5a3c514c9db4943b452f384706c33d26fd3de80086a978a24c6ac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114411, "uuid": "3e083ce6-2629-4fd7-8550-a214a49c8ec6", "comment": "Malware payload (Dridex)", "value": "d9e902a6144b35c95a759171fb6ab631b88a9a19", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114411, "uuid": "2422533f-7e74-4c87-8238-98f562a45899", "comment": "Malware payload (Dridex)", "value": "a61a629547d258137540909d3907a9d486e5834131af0529b71c56c9f0a12640a88255248dd72fef825949cd6a64481b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114411, "uuid": "065e1f56-0b14-4b3c-b859-82535aa2aaaa", "value": "A614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114411, "uuid": "7ded5717-337c-4fcb-ab1f-7cca0f90828c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114411, "uuid": "a50eb51a-f14e-4018-872b-23f5e292a373", "value": "3072:B3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:ZJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114411, "uuid": "c19d767b-7291-4a16-8327-e065338428f8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114411, "uuid": "1a668250-bde3-4c97-b55b-f40b7d3f9e43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114411, "uuid": "12c6a4bd-ad52-4443-8fe6-4ba220466d1e", "value": "67455fee28a5a3c514c9db4943b452f384706c33d26fd3de80086a978a24c6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c757fdc4-916f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119483, "uuid": "404f6d62-82cd-4780-829d-3c1e0f360c5d", "comment": "Malware payload (IcedID)", "value": "51bfa2a914997840e8161a203178951a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119483, "uuid": "badbbed2-c453-4bfe-b4b0-4d9c088239c3", "comment": "Malware payload (IcedID)", "value": "67a224cfef1265949fa49b0fddf9c0bc3511d3c9de2ff3952b12c024933d884c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119483, "uuid": "1971c38f-90ff-4030-838e-9019c1ea1c08", "comment": "Malware payload (IcedID)", "value": "f976070d5eb4a5c572a723cd5431d9dea847aea7", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119483, "uuid": "b3a23627-d53d-4b0f-96fb-66ceb43ed2f5", "comment": "Malware payload (IcedID)", "value": "dbc7dbfb237a1b377673c54f78f08c37ca0d2a870ecacfacf8d8e3183314580f3828269e1b9d98d1f52012b224199104", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119483, "uuid": "254811fe-9ddd-406b-b6f6-10768f60ee65", "value": "05B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119483, "uuid": "ad07b873-4d4f-493a-ad79-a267db57229f", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119483, "uuid": "5dfa6f43-aaed-4994-847e-4818ce40111d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119483, "uuid": "a604fab3-893e-4543-8b5a-6f711b25563c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119483, "uuid": "0a4bdd95-8cf7-488e-8f64-80985afd0cca", "value": "document-574116383.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3d9b84-9184-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617128538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128538, "uuid": "dbc9a7f2-bfad-4466-9c70-ddb19662cb8f", "comment": "Malware payload", "value": "41e8a3a0674a66e72e15270845fb785f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128538, "uuid": "6547363e-7a23-45f7-8a47-0cb91d26f4d7", "comment": "Malware payload", "value": "67ecda914c481ed2ad2eebab443bb37033777b7097c90f01046e218fadf203d6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128538, "uuid": "21fa99fd-c7c2-4896-90d2-65b3eb8e765a", "comment": "Malware payload", "value": "7a54f726afdde07e7c19e95a82ff161f6de1d2a4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128538, "uuid": "0cbf750b-b1eb-40f4-9269-3e79d3a0e6cb", "comment": "Malware payload", "value": "adc2b8dd6c544709bed8c641a7ba48e899e899aff90448c5ac1347ca5015015b9beaadae6e5a71b9e43c0ece1515df0a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128538, "uuid": "6dc487b2-84b4-4fd5-a85b-e498933186d1", "value": "0914BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128538, "uuid": "29d31139-c00e-4879-b4a3-94cd17279999", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128538, "uuid": "984a0e01-68a6-4609-9925-3fbf6c3acb9b", "value": "3072:Q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:0Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128538, "uuid": "652c5a5a-b5fa-4184-a2e6-8ddcbaaebacf", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128538, "uuid": "00459b20-3524-415b-90b1-aba45fee4827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128538, "uuid": "336272df-6ab3-4fd4-b4b9-3fd328fc365d", "value": "67ecda914c481ed2ad2eebab443bb37033777b7097c90f01046e218fadf203d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0450ba80-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114432, "uuid": "7c4deb51-766c-4e14-9d40-4cc8c393da5f", "comment": "Malware payload (Dridex)", "value": "dd0252bb2610d1443fdc1a06b489b2ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114432, "uuid": "6861731d-f32b-4e15-834f-819e5f8dff25", "comment": "Malware payload (Dridex)", "value": "683899fe77a5b1b96a5f729190393053c43ba6991a8bd48ea5dd2f46a6b0d386", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114432, "uuid": "c49ed245-38bb-4872-b93e-e9919cd68b9a", "comment": "Malware payload (Dridex)", "value": "c6b554445e67d2b84cb7fff7ca8d1f0596e2cd32", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114432, "uuid": "54a1b163-1765-4f11-ae1d-8ea581fbfafa", "comment": "Malware payload (Dridex)", "value": "12186f90c2d7af56de9da7e2ff90de509ab0382ca8e1477927a1cab76232063aeb7722559a0778ec6eb97d0643e4011a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114432, "uuid": "8a8d8c47-911d-48d9-9f15-85fea710bffa", "value": "2614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114432, "uuid": "2a20ee2e-daf5-429d-a76f-af04881bbf87", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114432, "uuid": "7018147e-086c-4649-8ddc-7118a3748ce8", "value": "3072:53PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:xJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114432, "uuid": "e69173ac-85cf-4b17-bd2b-1056c894e0e7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114432, "uuid": "b03c2bae-e28a-41ba-b21f-d877cf6e577e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114432, "uuid": "14e821db-4502-4d38-89a3-8683ea8741a1", "value": "683899fe77a5b1b96a5f729190393053c43ba6991a8bd48ea5dd2f46a6b0d386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc650270-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106687, "uuid": "309100bb-9f8f-42ca-ae7f-904bd062333c", "comment": "Malware payload (Formbook)", "value": "48c1ac6da1bfe585e060c49a2163a229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106687, "uuid": "cff44dda-1532-4687-a2bb-9d01e2101f2e", "comment": "Malware payload (Formbook)", "value": "6838e750e4d6b197819aedaeb8e0a183d5fb790da0d6d5e426d99f09bae758d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106687, "uuid": "ca070921-6099-4f30-bd7a-d8aba97fa23c", "comment": "Malware payload (Formbook)", "value": "611cf9f62ccbfad889bb1f5f326d0b4a210cbd6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106687, "uuid": "382e6521-fb0b-439b-acaa-9f3babbaa2f0", "comment": "Malware payload (Formbook)", "value": "38da91ade2f6de7a50afa7fe811efdd66a59db602548dd072955bbdcb551c854f46c5105f9618776b13c461a0cefc1b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106687, "uuid": "1e86711b-e925-445f-b798-09fe5bbf41dc", "value": "02D482A870AE805CEEB46634F5B595821FC959325F52FF3F28E66B002C63779F94E810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106687, "uuid": "7b934119-24e8-49c2-a04c-2fbcc0bd3388", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106687, "uuid": "f84aff90-4b71-4ec9-8b9f-3cd331630755", "value": "6144:2ObCO9gb62geej06YK66Ea0nxUm8h2uuzYW5lNcRP4+yGajkmSyzEehB/FXKQm0C:2ObCGgu2geu99T1h2usYM28EehG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106687, "uuid": "4835418d-3f87-4bce-b33d-3bc85a400f86", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106687, "uuid": "2f8c3008-3825-493e-bde7-817c4409a4e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106687, "uuid": "fd65065f-e25b-4990-b113-3d25ba8f75e2", "value": "Transfer Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647acad5-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115452, "uuid": "27bde3ad-eeaa-4c15-a5db-63c91bb1c1e3", "comment": "Malware payload (Dridex)", "value": "b0274aba7b907cfc7f6090217089a23a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115452, "uuid": "94479a43-d810-483d-babb-5d6c0a048692", "comment": "Malware payload (Dridex)", "value": "68498e7bd375e531e30f06cf33d6983e851d01ba6f7f2cc484571804a007a874", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115452, "uuid": "2bf8ee6f-0648-4d6f-8ffb-d088620cc38d", "comment": "Malware payload (Dridex)", "value": "7fd193cd2935591ecbbddaa9d3c47cd437230863", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115452, "uuid": "b482995f-a0f8-47bc-bc03-89422cef65c6", "comment": "Malware payload (Dridex)", "value": "df8e3e1283282bfa3d5e57e69219e16d1924cf5ee557a4be4ba97040b7be90170bd5d2dd2e925854f5ad7584975d3838", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115452, "uuid": "8499db69-5af6-4041-be5a-c76e82d98d8f", "value": "8514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115452, "uuid": "80de39d8-34ed-417c-be26-797d94288a70", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115452, "uuid": "88241df5-2244-4c41-b041-fdfb6604e4d0", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115452, "uuid": "fd254949-f630-4aba-9f5c-1ae0b654bd18", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115452, "uuid": "4538a20c-58e4-4df6-b39d-38fd587a6088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115452, "uuid": "3fe45a9f-f3ed-4b85-b9d4-56157460d703", "value": "68498e7bd375e531e30f06cf33d6983e851d01ba6f7f2cc484571804a007a874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae6fb9da-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127172, "uuid": "5bdcfcf0-3467-4c7b-a74a-c25d5869e760", "comment": "Malware payload (IcedID)", "value": "f0cfa286c922225077f81ceea06f80aa", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127172, "uuid": "5935dbbf-86ff-43bb-a7f0-7f7d2cf8aa0d", "comment": "Malware payload (IcedID)", "value": "685f0719619f96d771af4625995dc35cf3c82ce72c194eb5df1d7d324812d20a", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127172, "uuid": "9059c0ad-4ff3-488c-80fa-15911a83c046", "comment": "Malware payload (IcedID)", "value": "c2ab0dd3e0950bb139c686cab1b8b426c4d65241", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127172, "uuid": "2f5b98c2-c1ab-4646-8672-853edcd5bf84", "comment": "Malware payload (IcedID)", "value": "43259a5f89f83de4cc8d580c83f04594a8b04cdeed6217f318ef15b98ec1786c1ba2dc0e24954cb4b806ac3541e9262e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127172, "uuid": "cfac5d11-773b-4686-a460-a00577566510", "value": "9AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127172, "uuid": "ed2ece76-f099-4c37-b2e7-16a4883eabd2", "value": "3072:S2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:SzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127172, "uuid": "5d422338-1c8b-40b7-8a3e-1d0bf7716f21", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127172, "uuid": "0149d7a8-14e1-41fa-9868-c42548a67494", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127172, "uuid": "6f5e8dbc-372d-4790-9f78-502c75092404", "value": "document-214860149.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8bd790-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131622, "uuid": "868ef07e-bf35-4afe-86ff-2fd087118942", "comment": "Malware payload", "value": "39edb479af7258315224955cdb5f0d56", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131622, "uuid": "64b3341f-8e9f-4da7-b64e-c547a874100a", "comment": "Malware payload", "value": "690df931e61f49fd3cf0d803679f4c23afeff4306cd845db91a3a1533fb9b055", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131622, "uuid": "a6ab906a-b979-4db7-96b6-2cf118d13e2e", "comment": "Malware payload", "value": "8e0a1472887711ff4f6e189818160921e2aca18c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131622, "uuid": "277a1c0d-56eb-496f-a848-2e10671c2bd6", "comment": "Malware payload", "value": "d5f42cd2086558dbcb777638a2cdbbf39691699c1b8dd8323f24a6136db95eca03080163d2e8fdc8411e18d64a7c2c61", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131622, "uuid": "d4623af9-0537-4bcb-b644-514a9ebd4c2d", "value": "0914BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131622, "uuid": "9de87b26-c42c-42c5-9717-f9416b38d52a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131622, "uuid": "45d7f164-78fe-40ff-9e83-c2022ad54be6", "value": "3072:u3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:KJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131622, "uuid": "8d2de221-ae1e-4fce-a204-2595456e4445", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131622, "uuid": "0ccbc606-3ec2-4d19-b9ed-f8ba0cc84b47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131622, "uuid": "70e60287-5077-4366-8b8a-03e91fba4490", "value": "690df931e61f49fd3cf0d803679f4c23afeff4306cd845db91a3a1533fb9b055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c246f1-91aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144583, "uuid": "bd7b5d2f-99b8-4a6b-8925-a14a219ca6eb", "comment": "Malware payload", "value": "f36069ab0d1aefcdcc8233cb2d61c3c3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144583, "uuid": "2889e36e-4ee5-49a9-983f-8141fef7e6a2", "comment": "Malware payload", "value": "691095d72d71a6dfbe8f45ff9c208e20776caac33c55d0663227394d6b1e6483", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144583, "uuid": "f2ae20f7-eb49-4c0b-910d-66ef8fbe1b8a", "comment": "Malware payload", "value": "c0b87f2076d841780a5e058e564eba0393bce859", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144583, "uuid": "4228d28b-3a43-4adc-9677-5767cd9b4262", "comment": "Malware payload", "value": "ad6e5ba03361e87287d67b90dc03c29592f1830b65357c841c78011b9ece02f03eab94e69e6aff569dfd0b8c1a13bd27", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144583, "uuid": "d9140de9-35ca-49e4-a665-1b16144b0a7f", "value": "B714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144583, "uuid": "f1ac89dc-0c5d-41da-95e5-e2851fe644bd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144583, "uuid": "752c508a-4788-45ab-9556-e7aaa876b2d4", "value": "3072:d3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:dJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144583, "uuid": "000c3cc2-a806-422d-868e-0e6fa9a7e88c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144583, "uuid": "2295e23d-125b-42dc-aa12-b48ae75f857d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144583, "uuid": "1f8786d6-321e-4691-a714-9dcf14966040", "value": "691095d72d71a6dfbe8f45ff9c208e20776caac33c55d0663227394d6b1e6483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed2f6fb-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121590, "uuid": "247bc34d-5565-4778-a5b2-1a78efc35cce", "comment": "Malware payload (IcedID)", "value": "d06aa92d4248763d3bb0762d0e33bb86", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121590, "uuid": "e4085c2d-aacb-43e8-9a97-c84633b7da71", "comment": "Malware payload (IcedID)", "value": "6927cef8f9912c0dbd5fb859335f725a6520fd5650fac8bd94adb4bf1b333277", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121590, "uuid": "cb630201-719e-414b-9101-f26fa99a9fcc", "comment": "Malware payload (IcedID)", "value": "9793008c2a51b34747c05f6f13bdf0e7e3b9ee77", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121590, "uuid": "dc9567d1-4fc2-47cb-89a7-1b0c044b4beb", "comment": "Malware payload (IcedID)", "value": "88ec65c456f3ed3e1e8e6bb76d8f6e03752ca3caff1902f1d6641b1672e8e7fd3108fc7da111cc4c75f6f091f06952d2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121590, "uuid": "ed26026e-af45-48f7-9261-86893127311d", "value": "76B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121590, "uuid": "9ce8360b-8dbb-4e57-9630-5f500aa325af", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121590, "uuid": "c374d714-a233-4021-b173-640cc0f56238", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121590, "uuid": "1c0808cd-576d-4194-a67f-7e19d3dd5875", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121590, "uuid": "8fb9798a-6041-4a8d-9335-7a31e2cc1829", "value": "document-415416437.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2664c09a-9169-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617116636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116636, "uuid": "97c1885c-8d07-4e3c-be5b-4f401335b698", "comment": "Malware payload (Formbook)", "value": "687f9597b397ed8be5bd511e204082a8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116636, "uuid": "b945b4b1-cb20-44a9-acee-ac55c6005a01", "comment": "Malware payload (Formbook)", "value": "692a646b872460ad39f2c2e93e521ba614650a5e203e08bcf8ad092a6d2b7c94", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116636, "uuid": "74f48058-5d47-4203-bb46-f6ecec9ff2be", "comment": "Malware payload (Formbook)", "value": "2d7726c102d1e641d53415037857fbbbf19446ce", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617116636, "uuid": "02ed129b-674c-42a9-8880-6f17258a2d83", "comment": "Malware payload (Formbook)", "value": "e09842c6767ee1afccab9fd86521dffd338928d94f2b701cc77deedae737de815cfc5d82d5e78a608563426f46721e40", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116636, "uuid": "8002df56-14ae-4964-9434-31f8f69723a6", "value": "EFA4238C85283B1A50161D31B3EB8C29601EFE645E3396D6281067147B6727DFA7F3EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116636, "uuid": "eeedda32-511b-4097-9a46-faf99baa7806", "value": "12288:BLNCxvVg04bmIQWszfbCQYBJxgtxlEGs+muSLqbiU+:NNEvu3KIUfbClB70xuGs/dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617116636, "uuid": "6f474e69-07a0-493d-ac0e-8bb9cfa1161a", "value": 466629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617116636, "uuid": "9fbb6b6a-80b3-4223-95a3-aeda74933690", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617116636, "uuid": "0b05bad2-e8ab-438f-bfd3-50f4a5d92b13", "value": "MACHINE SPECIFICATIONS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c32a3a-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115399, "uuid": "cd74baad-39ea-446e-9192-86912b42563b", "comment": "Malware payload (Dridex)", "value": "c1ff16d9cbbd6073532ae8610dfd59f1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115399, "uuid": "3d0d2968-a67f-4431-b537-210ac7dc7b5f", "comment": "Malware payload (Dridex)", "value": "69526d8792fb63297bf4c1c6620d0839c33d8bb3d4ab99c5888607fba55559b9", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115399, "uuid": "53042e96-c257-43a1-8149-4912b2837550", "comment": "Malware payload (Dridex)", "value": "0ad6bbf211c3b7b8318204747037791a442e075a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115399, "uuid": "835379e0-8ca4-4bf1-922a-3f134d96d560", "comment": "Malware payload (Dridex)", "value": "b7c5ff06200e6678f29e3edd11c1a0ad1ca2279b46ca7c3bac8c5cfaae6bfcae31aac8e447a3e1d0e93ba254897de4a7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115399, "uuid": "0dbef75c-5cd4-45ad-a2ba-42cfbb847805", "value": "2B14BE2DE333D495FFF7CAF41492AA2A8A7B2D40821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115399, "uuid": "5aadf5a5-e00a-4ed9-801f-db1744ad215a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115399, "uuid": "8163a382-57d2-496f-87e0-253926ae865b", "value": "3072:03PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:wJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115399, "uuid": "cc02262b-bc65-4da9-ab69-b0cc5e62fce9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115399, "uuid": "754a9c60-35c3-47e3-aa5a-fb4343f34e82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115399, "uuid": "2e0b40b6-7ec5-4ba6-be10-b5f030ad5fed", "value": "69526d8792fb63297bf4c1c6620d0839c33d8bb3d4ab99c5888607fba55559b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53166092-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617087935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087935, "uuid": "da8ba2aa-2abb-43b1-8492-49d00ba420cf", "comment": "Malware payload (Formbook)", "value": "d34e115c2c11dec85d916779ff0dadc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087935, "uuid": "cce57842-09ba-469e-a5d8-7995014516c2", "comment": "Malware payload (Formbook)", "value": "695ab247db659d0c2d9cc11593b3670fd8103deda2134c021000671282245f08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087935, "uuid": "8f93bc6c-3ed7-4e3a-822a-3f5faf3111bc", "comment": "Malware payload (Formbook)", "value": "08f69fba321e9be7340fb7ae935e1b7e9db54856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087935, "uuid": "1dbdcdee-1975-407a-aa3e-8cd7a14a62a2", "comment": "Malware payload (Formbook)", "value": "6c4e9eb7ebe0b126f0eebd6f747898ccfeded122fb97e38866ad6d129bce6f3be23ce894c3ebf6af916db54222bb7cfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087935, "uuid": "11ae08a2-c34d-4b76-a0a6-e5afd8b1f2da", "value": "A0157E4C5B99C18AD5760A64C1D987F942A95EF2FB22CC6BA4C43FCFF5317C1A206263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087935, "uuid": "5c30bab4-cc15-4ca4-9c2e-a380e3934335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087935, "uuid": "482a0f45-289e-4fb7-8622-2a17c69b063f", "value": "12288:KL4JFdCiKZzoUAA9R6zBD6jPSuKeb2FNHxq30tsU3eVB:KLLZb/CFDVBeiFqMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087935, "uuid": "baa72162-5a4c-4b0e-8a15-b233017487e1", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087935, "uuid": "82952752-3b4c-4d66-a761-89309d1fec6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087935, "uuid": "0e2cce80-9ddb-475d-ae94-fed14d928f0a", "value": "d34e115c2c11dec85d916779ff0dadc3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bfb578-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126237, "uuid": "83298806-6173-457f-a816-c65cb8292134", "comment": "Malware payload (IcedID)", "value": "fa7e1f5dfd85a40113ae1357b8be6617", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126237, "uuid": "dc031fa6-12b3-4420-b0e3-dfe43861d711", "comment": "Malware payload (IcedID)", "value": "6962c82ca95e3804e022e42c91f1708f8912a7d798d9baccaaa13bc4a04065d3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126237, "uuid": "2f1d5a59-32e8-45b9-9dfe-21d1d4c7e456", "comment": "Malware payload (IcedID)", "value": "bd47d844a0c3806703f0edab089404934ada5058", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126237, "uuid": "48091187-098f-47c2-9217-e74681b5991a", "comment": "Malware payload (IcedID)", "value": "b2ff514a024478a24838136a7fa6d7ff21e58323029288824036120a9987414480a6b1f9e9fc4710d2b29149b82e5fb3", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126237, "uuid": "6592d5c6-9601-40a2-9f51-e02f3258b395", "value": "74B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126237, "uuid": "00e39f73-1e81-453f-8ee6-6341e816a4e8", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126237, "uuid": "72297b19-51cf-4c62-83d1-ab68f0ab13aa", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126237, "uuid": "1fed411b-7365-4c17-97b4-d77dca07c45c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126237, "uuid": "3251c3e6-5ca1-4616-ac50-dc47af972169", "value": "document-999876512.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387da375-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114090, "uuid": "f00b50c7-ee41-48d9-9ac3-3445f5878478", "comment": "Malware payload (Dridex)", "value": "5080ec10299f418ac00b9d9fcc55b4ee", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114090, "uuid": "a6a8c5f0-9860-4242-ab7a-68476123a7e3", "comment": "Malware payload (Dridex)", "value": "697bbd32258d786eabff05c6c584efe0b68388749bd551e1a183904a98ce807c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114090, "uuid": "9a862e46-8551-4b73-b583-cae49ba627c8", "comment": "Malware payload (Dridex)", "value": "23caf385159c6425e236abf70294dcbb5c9b40ea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114090, "uuid": "2f191b5b-dfaf-4f06-8c0d-4d957f7a2772", "comment": "Malware payload (Dridex)", "value": "dc88a9a22d653f855c5771dc9cf71d5f73ad7366eb0ee093ad47f3f32a35cc28c52b4d2441e806536919828b78d881c8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114090, "uuid": "76df032a-f28c-44ca-ba62-9f6d57c540be", "value": "7F14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114090, "uuid": "6f21ffcb-fd26-4440-9e0a-175c9c70a0db", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114090, "uuid": "b29754a8-fabc-470d-9cba-b2cbe8cc5e46", "value": "3072:Z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:RJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114090, "uuid": "ad9da43d-fd32-407f-814b-302af82cf536", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114090, "uuid": "65c12352-e18c-493b-9a7a-841cd64ed337", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114090, "uuid": "94870d42-fe51-4b28-8440-38613fb5ef29", "value": "697bbd32258d786eabff05c6c584efe0b68388749bd551e1a183904a98ce807c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc040f4-9154-11eb-abe1-42010a9c0039", "comment": "Malware payload (SystemBC)", "timestamp": 1617107840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107840, "uuid": "eff5df01-ab23-42b0-b223-23efe617ddae", "comment": "Malware payload (SystemBC)", "value": "d5927b50fee01b5fc563ece542455e23", "object_relation": "md5", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107840, "uuid": "068222fd-967f-4020-bcff-36eb62b51cff", "comment": "Malware payload (SystemBC)", "value": "69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6", "object_relation": "sha256", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107840, "uuid": "0f6e0660-8e30-4e32-b997-548c78cdc3ab", "comment": "Malware payload (SystemBC)", "value": "15c86056e1c53a9aad940d29c614e22cfde541d1", "object_relation": "sha1", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617107840, "uuid": "ef128b01-dadf-4c97-be57-6c54d13606eb", "comment": "Malware payload (SystemBC)", "value": "d60a3cf1a0fc68bbd41e113f3eb1fee0716e691e454489d7ad1d507ce718feefb429037a58dcfe4c84a24fd19245427b", "object_relation": "sha3-384", "Tag": [ { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107840, "uuid": "a9eac7ca-dcdf-4cf5-8d0e-b338f9c63fca", "value": "E6D37C1175C0C8B2E5951A724865C7E21A3AFCB5CF254BC77B843A7A5F363E18A36383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107840, "uuid": "188d1c20-b176-4c26-acb3-15f11ed333f3", "value": "ec0f21e7e4809b14137a504884075699", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107840, "uuid": "ce788c6c-148a-4da8-ae9f-52bf379a317a", "value": "1536:DOXnbT5j63o86v0p0by2FRRrF+LgCFF95j3lZ416xBta8irLQJ5yEkwXsW9p0:D6bT56Z0ddrFY5w63Ivc5ytwXX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617107840, "uuid": "1302bf61-a7fc-41ed-bf3a-c7422ad194f2", "value": 140288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617107840, "uuid": "ca4df595-deb7-4540-92d3-f0431efcdb1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617107840, "uuid": "43b1c357-3842-469f-868b-1072705bbe9b", "value": "69f38d5d3e6f1a2d110cfff202678426e1e2007260d0fbb1d58fa5a080d40db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0320e0fa-9121-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617085653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085653, "uuid": "4aa4de87-5f94-417a-9d00-897771aae62f", "comment": "Malware payload", "value": "fdda61e683440346a05f5001a2945921", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085653, "uuid": "b29d2ab6-2ccd-473d-8088-784cf95f6897", "comment": "Malware payload", "value": "6a051142ef80cc145800e75debb4c0a5f5b1488de8fca430d5fd0f4a70211179", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085653, "uuid": "d63cf730-6df4-4991-aeca-c5a15791ab15", "comment": "Malware payload", "value": "053119098aa42bbb4946e372974526fef72423cf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085653, "uuid": "5cb708a4-0663-4715-9d41-b048c913c413", "comment": "Malware payload", "value": "f61d55075e11c44ddace3fcf890a67f530cab72654fcee898fec028eec85a8fa746708cd0a5e0c34c254626f5a71d334", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085653, "uuid": "3ae71dce-cf30-4a20-be03-283132fa3a24", "value": "5CB4235073CA7E0CEF0BC6ED7D31C083E056A5AC9B568295A3B64EFEA487B464F79101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085653, "uuid": "eecbd625-b5b0-4367-8b15-b5067444d0a9", "value": "12288:QHRTij02/PoeVyQFg5xo8T+PyVNgt+010GIPgy/NeoJl5:QG3ZyQatTdVNgwNPvpl5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085653, "uuid": "ffb0811e-b119-4a7e-b35c-d997012577b4", "value": 500077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085653, "uuid": "8a786ddd-32f3-4b56-a6f4-1e9a5567d0ef", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085653, "uuid": "0cdc61e3-93aa-4eec-a888-4f2fff859111", "value": "Documentos de DHL..PDF.....gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe91080-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114417, "uuid": "86251e6d-639d-4eaa-b301-2cab943ce3b9", "comment": "Malware payload (Dridex)", "value": "e3e82a7db8b0ff98259b65918d4609c4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114417, "uuid": "69ca881b-f890-4726-9b11-05f27325cab0", "comment": "Malware payload (Dridex)", "value": "6a9bf80f18b810533307f1159c9f625182df49f23169d8c057ae2133b17fd99c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114417, "uuid": "51808e58-0888-46c7-8413-dbb66a231273", "comment": "Malware payload (Dridex)", "value": "b1198fc579074ca3d93f53e2beab814351ee5cb1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114417, "uuid": "7a35547a-4371-4aff-a89e-e8190bae9ac5", "comment": "Malware payload (Dridex)", "value": "c4f4ad34117fbb93297de269dd9fc071d42769a74730df31c53879677fd1a11d82b68ed8412bfac60a90fbe21bd8d94a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114417, "uuid": "bd75fd7d-d480-417c-a3ec-34187a5f541b", "value": "1814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114417, "uuid": "2c6ed107-19f9-499e-866c-f31cff5f526c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114417, "uuid": "86e741e0-fba4-480a-9c1a-d589b80183ba", "value": "3072:73PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:bJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114417, "uuid": "b3395197-dcc1-499b-9ae5-2dd41ea8c35f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114417, "uuid": "703934ac-9fd3-403d-8044-36176f066029", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114417, "uuid": "c13d08cf-daa3-4040-b91f-5a69194d464c", "value": "6a9bf80f18b810533307f1159c9f625182df49f23169d8c057ae2133b17fd99c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92af55cf-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617088042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088042, "uuid": "f3855566-1724-4691-b7ee-140c1b8dbc51", "comment": "Malware payload", "value": "a8d85a603b280c89f12624490ec4186d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088042, "uuid": "9e922d22-3689-49fa-a394-0938d72153dd", "comment": "Malware payload", "value": "6ad69ce7cdee301f2decdf2989d8c42e730fa70b144eec3710534a6374f45ca5", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088042, "uuid": "f7c91bc7-e39b-4157-9e11-b86c9d10e33f", "comment": "Malware payload", "value": "dbee96c19382afd0eafb246abbbfc35a60f025f7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088042, "uuid": "63fd54a4-171e-40d2-9c80-f14a08f1700a", "comment": "Malware payload", "value": "476dcae3db87afb4075723280816350f1699bd4e9572cafad05085ef324d6be6f28db64d0fab315f7ad31f2dc27cc90c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088042, "uuid": "3b6b5955-6799-4835-9879-913f498f1e8d", "value": "978423A76E03739BE5FA78FDB811CA00546C48124CA593F17A2F3247607BA9CE447CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088042, "uuid": "856bd366-76f5-498d-8623-6c53c599df45", "value": "12288:csP+2VqfZ8ULBbOv2R9Ojlu3qHaEbjntzAU89:c1BRxk+ow8astzAb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088042, "uuid": "a58817c6-1cdd-4da3-b2ba-c7ef90e10265", "value": 398082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088042, "uuid": "aabf6c6c-f09a-4227-a476-26a7fc7286d9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088042, "uuid": "0b81f860-82d5-44b5-8fa3-8a06fc1fc984", "value": "yeni sipari\u015f pdf xxx FBacN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bdad93-916f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119477, "uuid": "f8f76061-8c37-407d-a106-e15175637165", "comment": "Malware payload (IcedID)", "value": "133ed6b3306ac5d28f1a9e5d6c352056", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119477, "uuid": "d2ea0a4a-6f28-4a5f-b99f-fd41093b691a", "comment": "Malware payload (IcedID)", "value": "6ae7d45010f122a4c792f91ddf93a7fa99b05d50044c312d34dc44e1454e7de5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119477, "uuid": "e2ba2a51-9034-4c15-a22f-413d13386633", "comment": "Malware payload (IcedID)", "value": "1f496077fcc57705d6accee2c6f8205d745f7c1d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119477, "uuid": "8f677a2d-424b-4060-8a05-117489c5064f", "comment": "Malware payload (IcedID)", "value": "d5b117d06b0c26b848eeb4c1bc85fd40c8e61cd06adcd97df6c36e406f5b33c5dfc7e785d94205cf194de784fa348527", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119477, "uuid": "0ffd3144-6b67-4bce-b96b-aa828b724244", "value": "71B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119477, "uuid": "21b4da7a-4f8a-46a5-ade8-a702794a1fc0", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119477, "uuid": "feaa0114-2d2b-4fe8-8ffd-b76b3be612a6", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119477, "uuid": "e6646d80-41c3-4a7f-a09f-bccc11aa4afa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119477, "uuid": "a7a444f1-87f8-4dc9-b9e8-c26f1803c759", "value": "document-1480155714.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3e278a-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "ce0dac71-a03f-4b9d-b88d-f2a92e81233b", "comment": "Malware payload", "value": "5ce0ac2a289519407364e6393c06e0ab", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "dcd59ee8-a6da-4b36-a54b-833ce7428147", "comment": "Malware payload", "value": "6b20e92f6e8a1b5a298140e2eb6f8d8e3cb70b82c4fabef4269c8155041fb6b7", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "f9cc8ce4-0b92-4aaf-887c-4958003a0e95", "comment": "Malware payload", "value": "5104ac90036cceb2251763f0129b8920ea361206", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136507, "uuid": "52605dfe-9303-41ff-98c2-1cca3263bc70", "comment": "Malware payload", "value": "6bdb88af2f7586c65e5fa0acb1833d963ea15b1303108d16aa65fbbaf6405790d5b91159eb6bfc5c245c27fe86a7bbda", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "629e01f4-71c2-4622-9520-70f42e038226", "value": "5814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "847a80f7-49b0-41b0-b485-73be6c07d3ee", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "d0b20c1f-edfc-4574-883c-098155416306", "value": "3072:93PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:9Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136507, "uuid": "e26273fc-511a-4862-8144-0a834ba47b95", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136507, "uuid": "5b8c3724-9c64-4c7b-9838-945c60e94708", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136507, "uuid": "5b920a0a-f617-42fe-ad69-c9b2fad635a2", "value": "6b20e92f6e8a1b5a298140e2eb6f8d8e3cb70b82c4fabef4269c8155041fb6b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa0c7b7-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "e5b91d36-2ccd-4bf7-a705-7be359b12c88", "comment": "Malware payload (Dridex)", "value": "688bf0b049632a7d3b787684202d18c4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "4a36781d-9992-42b6-a509-031e4f1abd21", "comment": "Malware payload (Dridex)", "value": "6b616571278c3e6e8d09dcf9e93fa139dcb7c618544c38bb8d804f6029c359fd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "04979d98-faa5-4b50-8e10-5dc4f3eb32c8", "comment": "Malware payload (Dridex)", "value": "b36520b1cce43ea5a6931e56aac6bed6f3dca545", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115229, "uuid": "54fd5e18-0fb0-4a74-b83b-fb08c4e82862", "comment": "Malware payload (Dridex)", "value": "51d72ba2db116bf3958cf707db6e7f10164eb1ef4b4c7788bca504015ca901b9f5b707abd00539ab3130c2e3e4582402", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "30fd52d0-32ad-4904-949d-2d651eb9c7f9", "value": "A614BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "a9c63df6-3d03-4333-8bac-ed078233d6a3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "b773e8ee-6849-4381-81c0-fc9c658630cc", "value": "3072:P3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:nJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115229, "uuid": "e5b6d094-99f3-4f3b-9055-79b2ecf5dff2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115229, "uuid": "396f97da-9b06-48de-99d8-64bb661734a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115229, "uuid": "e1cecda0-f28d-43e6-9ba5-85b3f41232b0", "value": "6b616571278c3e6e8d09dcf9e93fa139dcb7c618544c38bb8d804f6029c359fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5972444f-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617108561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108561, "uuid": "d1a40a57-660d-474d-a613-4d0514cd7c17", "comment": "Malware payload (SnakeKeylogger)", "value": "d79802872b3f9fad225ec164abed9be3", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108561, "uuid": "abe15c94-87eb-4cf5-a3d4-d4126c42d8a7", "comment": "Malware payload (SnakeKeylogger)", "value": "6cb8dfc106cd5a74b25d1d20dfeda463a610825f6153c70e3399da85777e58f8", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108561, "uuid": "08b78bd0-06e2-4a05-acf5-84223bc87dc5", "comment": "Malware payload (SnakeKeylogger)", "value": "1a2e21861abb5bbb4fa093a99d4f0661e4a43932", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108561, "uuid": "a9c58a7f-7e24-4ddd-af2e-954a80ba6f66", "comment": "Malware payload (SnakeKeylogger)", "value": "82e583b228e72904a0d6f948cd8716250073c9e3eafbdcd7054dc4a1b0a2458c04686c80953ee2ce6cfbf5056af47fdb", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108561, "uuid": "eb2bb272-d358-48d6-b0bc-0428752a6970", "value": "DC25917830FE4259DEB46234F6B581420BC41E35DE92FF3AE4A616406D53BE8FA4E41B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108561, "uuid": "8e065732-05c2-430e-a57e-4e7c8204a7a8", "value": "12288:mbNjyxaysucRdIsRlIg23t0PcWOkzp1PlwDQvi3kEznE65UQMY125nf:W/uhDucWOkd1i60fGQ/2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108561, "uuid": "60e0b919-a38a-4a3e-a50c-9d0831b5ed4f", "value": 985088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108561, "uuid": "8845d208-1002-4a49-af4b-06f12c26e28c", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108561, "uuid": "76750783-51d8-4a0c-b859-5fd44ddb39be", "value": "RHQ_AO98789009_032421,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3ba0fe6-9106-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617074326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074326, "uuid": "ed105be7-a082-4a11-9689-b4634129523e", "comment": "Malware payload (Dridex)", "value": "72a78f73900f015106d45b1d1d6149fe", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074326, "uuid": "cc434a8a-7791-41d3-8c15-b9a53d2c3995", "comment": "Malware payload (Dridex)", "value": "6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074326, "uuid": "701ddef7-387a-4f32-897e-398a7c9c47e9", "comment": "Malware payload (Dridex)", "value": "820d8d057c14f3b3a632fc5df43c0e3f66b88cd8", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617074326, "uuid": "7aee8a37-868a-4b9a-a46b-63e5b65f3bf1", "comment": "Malware payload (Dridex)", "value": "21597e1f3ab38649559b4b29621b486f48c12b9eb4cfb52bb4054049dfe5a746a0206b0e326ce461b0c2e86e3b72c143", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074326, "uuid": "7bf8ea60-1e38-4e18-a520-437d4e8c47be", "value": "44C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074326, "uuid": "b87cb184-fd22-468f-bd4d-1af9856ed6bb", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074326, "uuid": "263a4b9e-c56a-4895-b86e-c3089bda5597", "value": "6144:OGiMOQpsduhD3AZHC/uNbExd+4Zuwz1b0717WLmw6Xg6DqaIDnnlvghr5la:/VhDQZHC/uNY3/zRm8LYQOQlYLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617074326, "uuid": "5b261836-df26-4181-80bd-b00e20a6edf1", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617074326, "uuid": "80121b30-4ee1-4f77-b5ef-5a04294878c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617074326, "uuid": "ce1d8f19-fd86-4a20-9185-79906b40c53c", "value": "6ccbc34952f3895fb847368112f920a4bdbc3c1ecab0c0ca1ea0d66da26ae0b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467cfdf2-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114972, "uuid": "89b44345-2142-451e-a21d-4b265c2e6b2f", "comment": "Malware payload (Dridex)", "value": "dccd65382aebf0d50f709cf9f6f3734e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114972, "uuid": "26b8abcf-530a-486c-a590-3b9cc86b3808", "comment": "Malware payload (Dridex)", "value": "6ce12c218430f645d549a4ba0ba677cbd0cafc3daa609928e729368066b06083", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114972, "uuid": "43011d62-b460-4aaa-ae92-6a2bb34e4b2e", "comment": "Malware payload (Dridex)", "value": "9b370833f6d6abd97dc9f22828d5530efef69edf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114972, "uuid": "0bd36601-147b-4170-8462-249855dd5ab2", "comment": "Malware payload (Dridex)", "value": "c36e36def4e8c51c49f7d3adb93dd37244eb18e9b2bfbd6e168dd947f41aec6939b607d1c3e294493a3f079fefabfa5e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114972, "uuid": "5f9d96cf-dd38-4024-b0bc-0db4c5afb018", "value": "9C14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114972, "uuid": "9dbf46f7-ae85-4d00-8f12-1223818762ee", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114972, "uuid": "15d6d41a-eb70-4837-b5df-a036ee663bb2", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114972, "uuid": "9c0c9a4b-eaa8-434e-a7e9-e9b848ee0c4f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114972, "uuid": "219f74b0-b4b9-4e83-bd23-5b7926cecb17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114972, "uuid": "4d9ba462-9745-42d1-b053-da14a01db816", "value": "6ce12c218430f645d549a4ba0ba677cbd0cafc3daa609928e729368066b06083", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c50e8f-9194-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135161, "uuid": "3ce56f10-ffb8-4753-9ea3-0f0476639dbc", "comment": "Malware payload", "value": "3cdf186032e4231e1be19919b496caba", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135161, "uuid": "6890d5e7-59a2-4e5b-859b-8cd5fc60c086", "comment": "Malware payload", "value": "6d1d727248f88140bf25d00f074c4eff1c0c79bc501c7a87d60e1da9b567e743", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135161, "uuid": "592766b1-f4b2-4a11-bd40-c6999d9c381c", "comment": "Malware payload", "value": "4b1741fee095080e05abd14bf37ece19336a7d77", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135161, "uuid": "d7964d03-9dfa-402b-a262-f7b862c6fff0", "comment": "Malware payload", "value": "889e47d5c21cc3f08426ebc5c564f99bd3763509d252e9d48a90c9ba275f6d6e2d41ca1bb2459e9084c9f25b7c0b1abf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135161, "uuid": "bf450d0c-d776-4644-80e3-700469a0ab65", "value": "F814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135161, "uuid": "dc16becf-37d9-4927-964c-a73b9e678415", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135161, "uuid": "98046905-a14c-48d6-b165-6d7659abaa5b", "value": "3072:T3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:TJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135161, "uuid": "841ab74e-764e-4320-9971-fa419ad69fb0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135161, "uuid": "61ea7ecf-817c-477b-bdd0-5ba7e2025a7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135161, "uuid": "b38d54be-19fc-428d-b5c2-1b27556d3d3c", "value": "6d1d727248f88140bf25d00f074c4eff1c0c79bc501c7a87d60e1da9b567e743", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33aa7cce-9182-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127396, "uuid": "3422e942-dce6-4dbe-aff6-b9e54d5677d3", "comment": "Malware payload (IcedID)", "value": "77fe7ee02c46e0245483d4d05600bbeb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127396, "uuid": "ee33e624-d121-441f-9aff-ea7cac3b8174", "comment": "Malware payload (IcedID)", "value": "6d5506bc1f15217532277b89f7c9e6c026b51893278858afcc336a9f7da2507e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127396, "uuid": "4b35d836-daba-4434-87c0-fe0f06f76ad1", "comment": "Malware payload (IcedID)", "value": "b49d6fe5b204b0117143aae37969719bdcb7ba18", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127396, "uuid": "3a2523ed-cc79-4675-98b7-e9b403ec276b", "comment": "Malware payload (IcedID)", "value": "ae48be9de52f154cbfb520fb6ada4a605edd82f72b5ca220dfae15d26c1bc3c2ed49fba054b15a350ff3c710a48e0362", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127396, "uuid": "dfc3dc7f-59e5-4623-96eb-c848306e3517", "value": "22B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127396, "uuid": "fb5667db-6371-4ae6-866d-4175759216cf", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127396, "uuid": "cadc4c09-6f1d-4b7d-808b-bf3e0b6f7e45", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127396, "uuid": "6746e572-7907-4f6c-9388-cb3eeec6f890", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127396, "uuid": "98525fc5-b264-4db1-9824-a433491698ba", "value": "document-59116836.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa9a0a54-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121582, "uuid": "94066afd-454b-4eef-a846-4f0404dc160f", "comment": "Malware payload (IcedID)", "value": "b8a8e3dfdbf48959b4e13b127da779d0", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121582, "uuid": "25aa58f2-69e0-41a1-b634-1d2beb396d2a", "comment": "Malware payload (IcedID)", "value": "6ddbb6f76edac8e258c325ba288e8f53e45d2a288316eea9e6e7ce2237c184e4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121582, "uuid": "6392d48b-09ad-4b3f-b821-2b66a213567a", "comment": "Malware payload (IcedID)", "value": "4678b0affcc24b8b6c6fdd4ddca5e13325b4b2ac", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121582, "uuid": "d1684177-a628-4120-8cb5-543badffce8a", "comment": "Malware payload (IcedID)", "value": "49e95ec870cd3a0ea8f4e056c2c6d64d8308a6c6401ea2beab0d8f0571568d7d77e31c1855e4825b49d54fd9d61fa661", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121582, "uuid": "0e0b66b2-b534-44db-8649-05a88eea5676", "value": "A8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121582, "uuid": "2230f64e-3b4b-441a-bf65-203ae9998e31", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121582, "uuid": "5b649bd4-72db-473c-b475-b6d23f4a3faa", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121582, "uuid": "86ccf64b-c8fc-4c9c-97f1-89fac3aad861", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121582, "uuid": "a484779f-b8f3-4c89-9f90-0d2880880e9b", "value": "document-2007765189.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378199ea-9182-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127402, "uuid": "98bed957-e0c5-4f48-94cf-de36205f5ce8", "comment": "Malware payload (IcedID)", "value": "81884c23ea9e11cd40380d56c808a090", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127402, "uuid": "d9608ec9-88a2-4900-9c20-1ecc505e761e", "comment": "Malware payload (IcedID)", "value": "6e11d279f93491f79822cf99c3264fdf7bf2fe96eaad147206012400af1f36ef", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127402, "uuid": "587fa987-1bb9-4fd7-a29a-fe73bf5cb8cf", "comment": "Malware payload (IcedID)", "value": "a89f0b936ede7cdb173ecc7e3955ed3b31d8d04b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127402, "uuid": "897c7477-08f1-47d8-81ab-7ca3db779074", "comment": "Malware payload (IcedID)", "value": "a68359acc58368d431457e5808596558d7ecc01a71abf5ace06cd963d19b7a321449782119b42e1179d3701fc0e6b4ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127402, "uuid": "5ef8709f-f254-4917-b999-c2a83b3282fa", "value": "CFB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127402, "uuid": "b236914e-7b60-4d12-b1ce-703932913512", "value": "3072:o2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ozxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127402, "uuid": "b7eb5240-f486-4c9d-8c15-bc726ec52dd0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127402, "uuid": "bd496faa-3335-4ba7-afef-5ef25d39e818", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127402, "uuid": "df0c744c-8a6f-4157-b418-956788dd102b", "value": "document-325722521.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0da3cb1-919f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140088, "uuid": "5ea91ea9-8ebb-4986-8a35-fede04e76d85", "comment": "Malware payload", "value": "78e3994be0c8c73595608ae0b721e8d0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140088, "uuid": "b62fec83-f8cf-4575-b78f-3544f2011cfd", "comment": "Malware payload", "value": "6e12aab387dc4f3af37f6d596f6f841ed1e22427ec34cc6bb01507ba4e56900e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140088, "uuid": "f234f50d-6e70-41ff-871f-d2ccdbb70b9a", "comment": "Malware payload", "value": "41ef42c8a56085e21dcce2839501a2b2f286aef8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140088, "uuid": "18bda700-8995-4e67-8a58-f0ed5133d99a", "comment": "Malware payload", "value": "32ae9afb6b72145e49689b62bd87ac523f8876b63f8dcd948cc74ca964ef393d2b55b211455c597adb0f9efaad9039a0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140088, "uuid": "652e4927-9c45-49ff-a83f-e6e5e4c1c6be", "value": "AE14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140088, "uuid": "4c891618-3c8a-4c16-8a1c-21bc7f87eb2c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140088, "uuid": "cc87ae06-ed23-441b-890a-63c58c691855", "value": "3072:j3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:DJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140088, "uuid": "9b496d37-7b5c-45f4-a2b2-ac2347355b84", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140088, "uuid": "2660fcae-573f-4065-af7e-14410a747410", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140088, "uuid": "2f3d5d14-21cf-40c7-85e5-2a467dd3fbe2", "value": "6e12aab387dc4f3af37f6d596f6f841ed1e22427ec34cc6bb01507ba4e56900e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8832e92d-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108640, "uuid": "64aba22e-9d88-4bb4-836a-4868965715a2", "comment": "Malware payload", "value": "65a8e84ff3ae5cfaf162f55bd2d38094", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108640, "uuid": "95e7222d-2100-45bd-ae39-49826c1b86e5", "comment": "Malware payload", "value": "6e324a8c93ffd3e113ad544a9d2eff92e0a80bac5d9b52af6b737c4836b064b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108640, "uuid": "5f8c74d7-0fd7-4cd0-95c3-1a78c7a5b1d5", "comment": "Malware payload", "value": "e47be15f75f49a0b1c14eccf8a73a2604ad2b7ab", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108640, "uuid": "73cbc7f9-f4cf-4492-9e17-7b9cc4ae3ceb", "comment": "Malware payload", "value": "2c65a4ce80a2923e400e720d1329eb6847bd72aab1854128c45e15a8098b7c8ec4df6897a9718376783b13d895198295", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108640, "uuid": "f2c84f2b-e85b-44e0-8b73-ff9fe7db5477", "value": "4B931200102D48367264FD31B2F14DAA77C2D4462AA8674C7ECCFD597FDBD9483695E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108640, "uuid": "6361c547-daa3-4238-bf90-3fb1e0fdc04d", "value": "1536:IIn9Z/8TbuFYZlRKG7vzTCCjwsd+Hb6Uj5FElW07ogk8DQgD5UxI7f4PIFyKS:vn9JM/R5GCjw1LFElW07zk8TD5UpIF9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108640, "uuid": "ad315ab1-81d8-46bc-8835-222bcb596004", "value": 94117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108640, "uuid": "2486a4de-c413-4294-b0ed-b6c42a4f620c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108640, "uuid": "c7e1ade3-366e-4956-ab1e-9e3685acb3d3", "value": "impr_2928.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a02da6e-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120454, "uuid": "b5cbed74-9c4b-4f51-8372-cef624908dc8", "comment": "Malware payload (Dridex)", "value": "6b9baed2d7e610ffbbfbb0a8fb3ef73e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120454, "uuid": "3ab8c112-dff0-47fb-bb87-a2bc1aad304f", "comment": "Malware payload (Dridex)", "value": "6e4b0e99a257b2128defbfce77eb8576c470fbf5a5fc13a60793652aaf8970ab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120454, "uuid": "9ec6e709-7968-4ff0-be30-e777ff8caa47", "comment": "Malware payload (Dridex)", "value": "59bbc2733261657d18f7c7437ee0ea01800ac962", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120454, "uuid": "1e22aafb-d2e9-4506-aa2a-7b805dab7886", "comment": "Malware payload (Dridex)", "value": "545b54d6a4bfbd0c53d71ba8d5032b7eff9c1edd634f67f70a36d92cb01b94b13fec00dc4b17acf71622821b53fd9b7e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120454, "uuid": "be42b43b-34e5-4985-8d5e-326c57b9b83e", "value": "AC14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120454, "uuid": "33e5c45c-9ccd-434c-809b-0b75da1890b6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120454, "uuid": "b8f194d5-f484-4c10-8296-e02e65753ba0", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120454, "uuid": "821b3a54-daab-410c-9308-3ab6d8e295db", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120454, "uuid": "19475ff3-55c4-4f1a-aa6a-50b3d19ad7ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120454, "uuid": "928a7352-251d-4cd0-8d1c-93ecd94d2803", "value": "6e4b0e99a257b2128defbfce77eb8576c470fbf5a5fc13a60793652aaf8970ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f179c9da-9182-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617127714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127714, "uuid": "7d0df361-5b77-4d2c-92c4-675f22f473fd", "comment": "Malware payload", "value": "1e5d71815b1caec3cd07d021cf17c8a0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127714, "uuid": "1fd2d179-0615-4158-8bca-44fb222de981", "comment": "Malware payload", "value": "6ea5519eb7f7f1057c7692943ea9ee63d3c74c8cc37ce8305c147cad859511a6", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127714, "uuid": "6693b1a3-51d7-48d5-a202-4c1e375583c7", "comment": "Malware payload", "value": "25a1b93f97754aad2191adfef7b7b80bdab855ce", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127714, "uuid": "b9f9e965-aeb6-43d7-afc6-0aa661768f3d", "comment": "Malware payload", "value": "a2956c552f992ee3f1445f0995ed4fa379bd289d344e372589b1efca321d24679b2d9d5f402f65d82d6be93992523119", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127714, "uuid": "365ba524-6870-4fee-aad8-ed8d7b80ec42", "value": "3614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127714, "uuid": "8a96fa97-108d-4bac-b182-4dc659a9b92f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127714, "uuid": "bb3df6de-85a5-46cf-aaf1-208b4daae382", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127714, "uuid": "a94fb42c-1691-4845-b130-cc4d68471997", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127714, "uuid": "f334a1e7-1c4e-460d-b465-b20ee9d30c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127714, "uuid": "39632ca7-3af2-405a-9c0f-301fe7f281c0", "value": "6ea5519eb7f7f1057c7692943ea9ee63d3c74c8cc37ce8305c147cad859511a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26131307-9117-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617081417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081417, "uuid": "78a293f9-c72d-41f3-99ad-0e256cf9eb7b", "comment": "Malware payload (Gozi)", "value": "979d9b4b65141f1ba3ce89b96a9f16bc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081417, "uuid": "62ffc27f-36a4-4155-bfb7-e4803c8cbb05", "comment": "Malware payload (Gozi)", "value": "6eb9c1a0a8c539ac78ef7413a78479dbf6a3270f48c1ae79b4595aab0b299c63", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081417, "uuid": "873971bb-43d8-442b-8539-5feee7358b06", "comment": "Malware payload (Gozi)", "value": "66a0a4f55ad9ef6a190c40f107be30e7e367237c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617081417, "uuid": "811c6aeb-33ac-4db2-8009-8d0adec817c6", "comment": "Malware payload (Gozi)", "value": "15e969da35e6e12b46117a2424d472ae383e71253f7797ae634ce68180f1949396aace759802252a6d3720f559f32dc0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081417, "uuid": "d08b2972-16e4-4e0a-b66f-f8476b828fac", "value": "93B48D606D56D9F9FAA7A87FE8588AA0D54C5F05BFD4E0CB230E32D0BC7A3808577059", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081417, "uuid": "2c5c27ed-03e0-43da-a29b-2c07bd47ea10", "value": "2205f3f36b780a98bcba0a7d38575da9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081417, "uuid": "2265ece4-5537-49f5-9385-2b44a66efe6d", "value": "12288:YwjHBt6R1/4EZe5givWOHpHGjtJP4pPmyIzY5xf0y:bjU1/vZe5gcWSEJPKLIU50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617081417, "uuid": "508dd008-a3d4-4b5c-ae39-5e2efd0685cf", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617081417, "uuid": "06098ec7-6270-47ef-bbc3-ad22b71704e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617081417, "uuid": "9a6a614e-b371-48c8-87f1-73528e5cd55f", "value": "signin.jpg.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d0b914-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617106834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106834, "uuid": "6f58571c-23d9-4830-99fd-62b9c53e137e", "comment": "Malware payload (Formbook)", "value": "61da8b74b086c5ebd2f5d5d2e7a40cb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106834, "uuid": "8424be7e-435c-4a48-890b-e3d21a2a9731", "comment": "Malware payload (Formbook)", "value": "6ed0d423728047d9d099d38c7322f3fdc957d9593a2a7dbb66f4e47a5f395721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106834, "uuid": "834d135b-24f8-45c0-b9d5-e5a25f59c54b", "comment": "Malware payload (Formbook)", "value": "2d91114053fc58ff0b4d5fdc3434332d4107313f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106834, "uuid": "deafb0d6-9210-4f5b-b000-6899ab189320", "comment": "Malware payload (Formbook)", "value": "ee74383e88aaf413c99e2020c2d428c5aba89d1769b49e4bd477178421aa17378ecf1d776bf0b8f29931367db27785bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106834, "uuid": "b69550ad-ebde-443a-ad6c-13bb27e42fcc", "value": "9864CE1177D0C032D19764728665CBB18FBB7831253AA98FBBD01BB95F253E1E62630A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106834, "uuid": "aeaa6719-56a4-4c24-a933-f3078b3954c1", "value": "a5a5cc7961686b2049e8c149d115d4e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106834, "uuid": "5e4902b6-39d6-4b19-b986-6b8a73ad9b3c", "value": "6144:Kb6NyuGZeLB6m3Fc/GXSEwJAHnk2eK+rWkplAUgPkPX:K2NyneV6cFHkAk2WVpl9nX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106834, "uuid": "b3016553-e842-463d-93fc-370ee9d2bd7b", "value": 329728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106834, "uuid": "b0a5892b-1202-4a0a-8a03-9a56a768679c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106834, "uuid": "3ad2a434-5f05-4250-8549-5cb1f7ffe81d", "value": "PO.34233.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3148c3-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132916, "uuid": "a45b141d-b796-4684-b527-6b4c169e5a70", "comment": "Malware payload", "value": "5aae6c14033f5826646a0bea93cba939", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132916, "uuid": "0c218c1b-2c6f-4781-9f5c-79ace97bc159", "comment": "Malware payload", "value": "6ee2b496b2ce16abc270a0892175ca7e479706ffe6714b2e457b19a032db0c46", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132916, "uuid": "2de1d122-8b21-4cf4-b1d2-3827861d742a", "comment": "Malware payload", "value": "2a15875385d63418ec5b133dd8a1d198f82c679d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132916, "uuid": "3b3aa229-e928-4910-a3cd-f6c8cfd2ba14", "comment": "Malware payload", "value": "407e0353becb2bfdefbc9fe7dc410188ccaec2c53114adb315115753550968848f5043cda30a7c1b57f55abcf737b251", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132916, "uuid": "38e40b57-bef4-4b72-8aeb-163073272d1f", "value": "1314BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132916, "uuid": "ea68b1c9-d641-4ccb-ba51-5d573ca713ea", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132916, "uuid": "733e8093-7d32-4669-b0bf-fd2847627908", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132916, "uuid": "9a5dfeb8-ffdc-4f86-979b-a4717456ef37", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132916, "uuid": "b979cf10-641b-44e7-80e1-04a6bf5eadcd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132916, "uuid": "3d5ba096-5a4f-49aa-b271-0dc95e79734e", "value": "6ee2b496b2ce16abc270a0892175ca7e479706ffe6714b2e457b19a032db0c46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29369d16-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122224, "uuid": "6f887cd8-2de2-4f90-a082-0a5bcf2108c8", "comment": "Malware payload (Dridex)", "value": "94c618399d73d9c97265063c46c4a360", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122224, "uuid": "2a53822c-57f1-405b-b19c-5341cb7c43f9", "comment": "Malware payload (Dridex)", "value": "6f01b71f3230615a95d839d050b7529e9cba2d7286be91696a49cea663bbaeb8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122224, "uuid": "9a108d6d-cb09-4eae-8741-5b4ae27def78", "comment": "Malware payload (Dridex)", "value": "34bf324774abb5e7ac6a251c2a84ab6c55053b3d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122224, "uuid": "767b2959-9911-43cc-97f5-7612f1806567", "comment": "Malware payload (Dridex)", "value": "22deebe04fcb6a63cc9fc419914fd99095959975115dbaf732199c5de8f7d911e9ddbefc10a9bdf8ce6c07871980b23d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122224, "uuid": "705e5912-bb48-4f67-bbd5-5a3ab98dfc25", "value": "F414BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122224, "uuid": "02737a6a-2f57-4a35-8c82-f311a47f6cc8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122224, "uuid": "ab030592-024c-46de-8cc8-23348a136359", "value": "3072:j3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:DJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122224, "uuid": "b0f112fa-eb1f-49d5-9e5b-91ce883c2659", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122224, "uuid": "29fce9b4-951e-4b8e-82e9-03b226b0e021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122224, "uuid": "cd256c7a-f2a2-4e9b-9bc3-8ca01c8c6213", "value": "6f01b71f3230615a95d839d050b7529e9cba2d7286be91696a49cea663bbaeb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa2810b-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "cfb293a4-f42b-42ee-9f8c-c32019244952", "comment": "Malware payload (Dridex)", "value": "a2d90d0a1a2b2813f4a2602d2da393ad", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "bb44c010-eace-4c90-b447-7e23746d41ac", "comment": "Malware payload (Dridex)", "value": "6f07c48664fb1ccffb54e23a7d4c1bfa6d4481962200bcab2cd9dbb41552f8a5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "d62b6d07-5b0a-4e31-adb9-7415d78bf1e8", "comment": "Malware payload (Dridex)", "value": "80665bef5be0c516880ed2c0771ce36eed51908b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114093, "uuid": "652c0c93-295f-401c-b25b-cf78f2fd39ba", "comment": "Malware payload (Dridex)", "value": "230dc6d62e2c91716ce1a9b6a263cb92133cff8e95abb1b50d5a1a9fb8f77491cb637b90e85968959579051c5a1e237d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "3cee083c-c1bc-4bff-8eec-96cc9058b387", "value": "5914BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "1c940af7-4fc2-4385-97fe-18ac76a40ee5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "69e75369-fb9e-471c-8ec5-f3bca6f6b44b", "value": "3072:R3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:JJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114093, "uuid": "6454d081-6a72-4f70-b06b-da83cdb7ee49", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114093, "uuid": "07b0cf46-8fd0-456b-b9e9-7fb08bd882f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114093, "uuid": "21366f65-fc56-42c9-8c3b-1dddc8b347aa", "value": "6f07c48664fb1ccffb54e23a7d4c1bfa6d4481962200bcab2cd9dbb41552f8a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36a2b6b-916a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117329, "uuid": "f506fd04-a34c-4a1a-8936-773097fa61c4", "comment": "Malware payload (IcedID)", "value": "473416c5b68523edbf061c60eff34a32", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117329, "uuid": "104d61a6-7dee-471e-9e68-64751132d791", "comment": "Malware payload (IcedID)", "value": "6f2264b4326bcfa3f47d4bda9504c428c85d026e530ff6074dd17e83c11fe4d1", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117329, "uuid": "04f49917-06b3-450e-92aa-b5364432f73f", "comment": "Malware payload (IcedID)", "value": "e53570d0c6297eb719ca02a96b5fa2a5adf833bd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117329, "uuid": "ddc7536a-628a-4c00-961f-da3379acb473", "comment": "Malware payload (IcedID)", "value": "25121d96d73d698699955e6f89f9a950bab4e03ce2a5fbd54fef862c92aeda1f7cdf6133350c16c9bae10823d79a0c00", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117329, "uuid": "8d398420-1275-4f30-bacd-c863c73994cc", "value": "7DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117329, "uuid": "87d2022b-fb1f-45c6-9678-5d0328f84ae1", "value": "3072:Y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:YzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117329, "uuid": "4cac4931-fab5-4e24-803f-2ff8cec3c97e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117329, "uuid": "97ac8e9b-563e-4fac-a4db-6e2a466bb06f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117329, "uuid": "4daefb47-3666-4cfe-b771-c16323ee3587", "value": "document-487891848.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a918fa2-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121878, "uuid": "f2a7d840-d290-4281-9143-b327a468cd54", "comment": "Malware payload (Dridex)", "value": "575ab37a4ad3984a63cdefe3b070d0ca", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121878, "uuid": "53da415c-735b-4910-a10c-1570c7e35927", "comment": "Malware payload (Dridex)", "value": "6f2a584e572935dc733293cbe5520c41d967452ec943aec258776dbf34a7a7a2", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121878, "uuid": "e3695d93-a4e7-40e4-98c7-861902537df8", "comment": "Malware payload (Dridex)", "value": "851c3bd0f32f6a4c3fb3dea7e1b28d6f55c2b0d2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121878, "uuid": "c142255f-eda9-4ba4-8096-6ff93b0cafee", "comment": "Malware payload (Dridex)", "value": "32f6056f1099d1609384a63635c45a6a22cc5d4ff7439b80ab1d54d981a157a582d91dbc17bd8b43fe6c5836bb850958", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121878, "uuid": "82159e5c-d85a-43cd-907d-17edf693b8d5", "value": "4314BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121878, "uuid": "8a4a5629-07c6-4867-a173-cfe8e2a2bec8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121878, "uuid": "65f6d2a5-50b3-4d3f-bff6-e3928910baf8", "value": "3072:Z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:RJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121878, "uuid": "62551883-3812-4f89-a702-1381d9a7894e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121878, "uuid": "e5101c87-d287-4c4c-ab7a-90a8bfdd403b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121878, "uuid": "745aadac-c6d6-4a84-94d1-1396cd7cf287", "value": "6f2a584e572935dc733293cbe5520c41d967452ec943aec258776dbf34a7a7a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6886cce-9158-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617109550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109550, "uuid": "c4b21b80-7abc-4c7e-80a7-e2940c38135b", "comment": "Malware payload (AgentTesla)", "value": "d8a66a32e8bff678528fdf619e7f9b39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109550, "uuid": "964fe267-e413-4ef7-8b90-51a4427a969c", "comment": "Malware payload (AgentTesla)", "value": "6f9bd7ae47e74636f141c046a0bddd37538376c8308822140ea3dbeeb68bea82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109550, "uuid": "1b269b26-c1b9-48bb-8778-ec4c8940c566", "comment": "Malware payload (AgentTesla)", "value": "9e1294e7a513a4bd544b16fbb1a0bdfc4342fd6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109550, "uuid": "ecf0913c-9010-475c-a601-0c01fe8bd0fe", "comment": "Malware payload (AgentTesla)", "value": "36b802fe4116985e0de0580df3e40835d9e4df62fbd31f97c7595d98b02e1ab1a733b99c27f84fc499d8d3b51b78bc70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109550, "uuid": "0eba16ec-6636-4f16-b8b5-8ccc3b14e754", "value": "2ED490A870AE005DEEB46B34F5B555821FC925321F62FF3F28E657006CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109550, "uuid": "2e1311f7-845d-444f-80cb-c6715657d7ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109550, "uuid": "49ef49dd-56bb-440b-92fd-7113738d6133", "value": "12288:FNT4kVU/kmHIyZPPfNUt5XC+8kUzoxHS:FNLU/bHvcAkHHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109550, "uuid": "9c718cd1-a5e7-4c94-a240-6c91a31fdff2", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109550, "uuid": "2830cf3d-6496-4aae-abcf-212aa16c9bae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109550, "uuid": "38a886b0-d3c9-4f2c-931c-3d9f357f9e18", "value": "d8a66a32e8bff678528fdf619e7f9b39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534062b2-917e-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125731, "uuid": "be5bdb5a-e2e9-405f-96b3-565f57f20db0", "comment": "Malware payload (IcedID)", "value": "3bafe7c1f1ceea8b422727b1a6f60e67", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125731, "uuid": "835eaff8-84d6-4912-a29d-922f01380a12", "comment": "Malware payload (IcedID)", "value": "6f9f895f2ad6a8c084b95c9dae6bdb774a9c3efceb308dfd590e57cbffac2f2b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125731, "uuid": "0bb17396-582f-4edd-a96a-4ccbd7996e64", "comment": "Malware payload (IcedID)", "value": "a479c1b52be0eb8ba39b8e0cb360a1d71c95f253", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125731, "uuid": "39148ae4-1301-4828-818e-80323c75bd8a", "comment": "Malware payload (IcedID)", "value": "8e6adaabef30a81e87a6c44166fd1afd949673f345c09e4e65121a2a670dc93963aceb99a63f9b34d1f6cf204288c6ec", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125731, "uuid": "450297e5-662a-4e6d-8565-bd467d2f7467", "value": "1BB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125731, "uuid": "59bfd488-0c68-4e20-9655-8f059bc2863a", "value": "3072:S2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:SzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125731, "uuid": "8a03f897-0061-4fa4-994f-a7f278e3c5ad", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125731, "uuid": "608ae7a8-25e2-4fa2-a810-cb041087fd72", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125731, "uuid": "6491754d-72e0-4e1e-a15a-7f184a667d27", "value": "document-923158474.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8b7249-9124-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617087362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087362, "uuid": "5c7b1288-97ff-49b1-907d-9885f4f59afc", "comment": "Malware payload (Formbook)", "value": "fcde57003043be74df8037641c9a67fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087362, "uuid": "97a7556f-601b-4dc2-b948-798184edea5a", "comment": "Malware payload (Formbook)", "value": "6fac6e1f7f8cdd8cec52b2dd7a23fd434084c7d12ef0f04deaa52794d3612ef7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087362, "uuid": "66c67275-f615-49c6-9112-42b304de42f1", "comment": "Malware payload (Formbook)", "value": "c4cb4ee29d8acd2b61a3f0f3916bc477add2a5ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617087362, "uuid": "c44ac8e0-86e8-46a6-80eb-a1263c75f1b6", "comment": "Malware payload (Formbook)", "value": "eb09a65db7ef925781cff8e2f8e673c25666821944e83055d64fde9bdcccee17a14a77bf54d604775c602085887fd0c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087362, "uuid": "de2d879f-fbf5-4430-9e7d-dde4f17222fa", "value": "6D24124EB2D04CA7D95A99315A7E517AF3FAF6542340004B17582EF97C212C6D8A73CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087362, "uuid": "88710a70-5f99-409c-892c-e6935c32fc67", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087362, "uuid": "4cc39cc7-6399-456b-aed8-82233c536714", "value": "6144:vAPO2JGtlLE1mKgZZAsJfv/vucCczUnQOY06c:zPqmssJv/SS06c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617087362, "uuid": "eb3c8673-ae1c-443d-94d4-4d29c0708d5f", "value": 230179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617087362, "uuid": "39504a72-1cd2-43ca-bfb8-f51c3243848f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617087362, "uuid": "491fb3c7-1435-4f3a-95e3-78d548409e7a", "value": "fcde57003043be74df8037641c9a67fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64d90bd-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127159, "uuid": "6d619438-46d0-46c3-9537-48301153a7e2", "comment": "Malware payload (IcedID)", "value": "1c9c1f95b194784c3604a0e48281c9f3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127159, "uuid": "d46c4691-0649-46c9-ad25-c184c69ce3f2", "comment": "Malware payload (IcedID)", "value": "700dcadc788e1b6b01fc39b9a98aae002d4fa6c54173529f8202f848662c760b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127159, "uuid": "8e31f921-2c8a-44ab-ba54-af2892e8f800", "comment": "Malware payload (IcedID)", "value": "0a265f79562fc574593b9949d2d87273d89c07f5", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127159, "uuid": "ff8cb91e-4788-4fe4-af45-f3d73d41f080", "comment": "Malware payload (IcedID)", "value": "b6f9be5f397944f6eb5ed3caaaa24fc7d60f941e5cbf5eb52c9cec9fb8af80be1a6f9c84505ada207a252c9ec9aca409", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127159, "uuid": "b1d04ffb-c4be-4ff1-9eeb-8223c8d46a1f", "value": "9FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127159, "uuid": "4706b464-195f-44a8-b00c-05a2b471131f", "value": "3072:a2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:azxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127159, "uuid": "12c1aadf-e500-47f0-be70-f5e2d67a1944", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127159, "uuid": "220de5a2-c899-4813-a3e7-458d5dfd3987", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127159, "uuid": "0244de1c-339c-4724-b8e2-4ca2c301beb9", "value": "document-1656906467.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e297e9d1-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142722, "uuid": "55e58b0e-4655-424c-87ab-55743f81b480", "comment": "Malware payload", "value": "9b618c1c71fdea12158ecea872767788", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142722, "uuid": "5f38053f-a5f5-4b25-bf72-018fbbdfbbd5", "comment": "Malware payload", "value": "70245d05d0d14ed69a45bc3696762aa9ca2d88a6d582c53bb6269c867dae5818", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142722, "uuid": "cfb16ea8-35f9-48de-9150-9c91f76f85bc", "comment": "Malware payload", "value": "c8fd9e54b201c6042bfe525571826f4c1440f119", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142722, "uuid": "8b984c67-3c06-47c4-bea8-2894661764f5", "comment": "Malware payload", "value": "ec9f8b4f1e0076bcd82cf0504a5c968d5418962e2bb0860c94ffc683f3eac33e803effe2520c83f73c016455c99ed359", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142722, "uuid": "143a170d-78c6-41f9-bf7a-487a9ffff9a5", "value": "F214BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142722, "uuid": "f299873a-e819-47b9-bd6e-1222a658ef3e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142722, "uuid": "dc8c8fa4-63c2-4208-997f-a43f759f6d1d", "value": "3072:U3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:QJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142722, "uuid": "72f11c28-29b0-411a-ad0d-52787868f854", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142722, "uuid": "895eaf0f-835b-45bb-9c77-1dde32165acd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142722, "uuid": "6989205c-682b-44ad-bf2a-c7ea276084c4", "value": "70245d05d0d14ed69a45bc3696762aa9ca2d88a6d582c53bb6269c867dae5818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2957d7a-911b-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617083344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083344, "uuid": "e3c71c02-5afb-40b8-8891-4e0621402c22", "comment": "Malware payload (AgentTesla)", "value": "0fcfb3e25eecdac8ba265528ad4ca225", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083344, "uuid": "fdf18bdb-a5cd-42af-9d5f-b2a65f5d9f06", "comment": "Malware payload (AgentTesla)", "value": "704b257ab6d3450715455c85d9de47b7e26a35036b00877e34421a41b3cdfa57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083344, "uuid": "0574df5f-0e85-4507-b119-3dfb9a64ab9c", "comment": "Malware payload (AgentTesla)", "value": "fce0031a5136df3570b42ba9ee174e02710e8d7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083344, "uuid": "3d363841-d4ca-4b96-ba8b-491d37cd1db4", "comment": "Malware payload (AgentTesla)", "value": "cf619b350e452953ab97fc7a3efd19b5e816010b03231bc9afb18067156de41f940d8f2d67a4d2dd33987b7b70c824cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083344, "uuid": "68974c97-2347-4696-ab28-afc98d6a9bb1", "value": "239423BD8095BF8D934F6190D27991AE1CD2073BD091B1B9189AE375C9E32F8BB341C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083344, "uuid": "0b69e597-7ad1-45bb-a7b0-913553c02bad", "value": "12288:/Dx9nhFFXSvtdPR39ZbTQM5Ymo+Om7KNU:rx9hTXG3D9zKNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617083344, "uuid": "bd1be926-f8ca-4d1e-b2b9-a5af788d20c2", "value": 441536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617083344, "uuid": "2e8e8a67-c841-4116-98f5-8d75c1e96c7b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083344, "uuid": "990b8c6c-1e0f-447a-ada3-42d4641eaa6b", "value": "Purchase Order 2021 - 00041.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffd9e4a-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136570, "uuid": "efe40c0e-97ee-4995-b38d-651e2ffd3d1d", "comment": "Malware payload", "value": "54fcaf959fd51fd1d3416783c613603e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136570, "uuid": "a55106ee-8c2d-4dba-80fc-15668dcd52ae", "comment": "Malware payload", "value": "7051696e3633a497f0e0ebeef0ff6dad2553433f4e0ef37b330c17a4a8a2642f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136570, "uuid": "d127aec1-9dfa-4ff2-8521-4022cf37e357", "comment": "Malware payload", "value": "48dbf8c50abf5b5b00e189c2e4c15f79a5ad2488", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136570, "uuid": "3dff95a3-b0ff-4077-b9d3-b2e76b623fbb", "comment": "Malware payload", "value": "a283e19747195872da4abf41f09c181236132188df3f6b12fe02bec0ff98fb58a0f84cac33855b71a1e1399ecd263a86", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136570, "uuid": "811f87fb-c343-4c7d-9312-924a37be5a9f", "value": "CC14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136570, "uuid": "7df0631d-26b0-4963-a58c-e9c73a2a858d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136570, "uuid": "45109e60-fd9d-4921-9eb7-e0ecc31ec744", "value": "3072:i3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:GJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136570, "uuid": "270ee34a-269d-4cb0-8046-2970f5e71cf5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136570, "uuid": "d6d75032-0b30-4b53-be9b-7d0fa269c80b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136570, "uuid": "6fe505da-50db-47f7-97b8-e20ad3961263", "value": "7051696e3633a497f0e0ebeef0ff6dad2553433f4e0ef37b330c17a4a8a2642f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98baa6d7-91b0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617147322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147322, "uuid": "c4a194d3-51cd-42d9-928c-11ab0162d018", "comment": "Malware payload", "value": "4c9999f3f68346e8a2af8b52a0f6b995", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147322, "uuid": "ab707fed-8cf8-46d6-8365-53be35c36fc9", "comment": "Malware payload", "value": "706f8858ea283cec7a75e78046fea2bf72621f9e66bb70444c5f8f49e1b4f074", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147322, "uuid": "6b6fd0c1-c095-4cd7-a694-4d65859051f8", "comment": "Malware payload", "value": "8b5bb313a3dc2de4cb5fe93a34ba99111531931a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147322, "uuid": "86f24423-2d13-49ed-bb26-5cfeeb4c5064", "comment": "Malware payload", "value": "fd5f0bbb8282dc7d6205ee01cc199870b49fd6c77f669e0129c4ecb9d5c08ef81b5ea0b24f7624d0dcb66d7a8d085c5e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147322, "uuid": "99fcdb79-bed1-48c2-a099-8d48047c0e99", "value": "4E14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147322, "uuid": "c38f292b-30a9-4b80-bd6f-14f27c752158", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147322, "uuid": "71e66fe5-99c5-4cf9-8d4d-1a13aaa490e0", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617147322, "uuid": "02cc81ae-c13e-4dd9-912b-91de32a43c63", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617147322, "uuid": "c32d031b-4bad-488f-8880-7c044791dd9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147322, "uuid": "09c485c5-b9fe-4ffe-937c-3299cf0d84e2", "value": "706f8858ea283cec7a75e78046fea2bf72621f9e66bb70444c5f8f49e1b4f074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f11315-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120581, "uuid": "689ff7e9-1eb5-4c18-9eab-bda8962a4864", "comment": "Malware payload (Dridex)", "value": "97a93430a4dea9996850f24a48eee087", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120581, "uuid": "da4e2b0d-536b-4bb2-a07f-36364e9417a5", "comment": "Malware payload (Dridex)", "value": "707c6f2dd625b6e78ee0a413e32365a349e913edce8d4d86bf9d131e475a4abb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120581, "uuid": "f7e9dd2a-365f-4af3-9bcc-0d4c133164ea", "comment": "Malware payload (Dridex)", "value": "ad142ed6beb832ebb2097ba76e6967baeb106ef9", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120581, "uuid": "a4ce198f-a8fc-4bae-aecb-57a120a8289d", "comment": "Malware payload (Dridex)", "value": "a38a49fa8ec513c8d56ef49489b9ec73f27a3e8268695999bd187035d1792d57219eaf3d01510522ad8c6d4ceea22425", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120581, "uuid": "541dada8-3fb0-4d11-83c9-a22601d70299", "value": "F214BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120581, "uuid": "4b77f8ff-2f5a-427d-8747-0f4496910043", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120581, "uuid": "f303e71e-c39a-43a3-a31f-24f2cdefa7d8", "value": "3072:03PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:wJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120581, "uuid": "f437b325-536c-418c-a1c4-eae8dcb75dd6", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120581, "uuid": "1d3190fb-989d-427c-aef1-df9055116ac5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120581, "uuid": "ff563353-640a-4d5d-b77f-c4b9c9423437", "value": "707c6f2dd625b6e78ee0a413e32365a349e913edce8d4d86bf9d131e475a4abb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f295034d-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "a29433d7-dffd-48f6-a6c4-cef684a228ca", "comment": "Malware payload (Dridex)", "value": "9a0a31102fa34869c68a86a0fdbc8f19", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "a9ce3d8c-cad1-4150-ad0c-b65d63a772b6", "comment": "Malware payload (Dridex)", "value": "70c7ea573fe33de3ac050fe5543f9a1b89443b2e66ddc5e01574d65f10cd468d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "68db19ec-18e9-47bc-a871-1cec3f1d470f", "comment": "Malware payload (Dridex)", "value": "448b0786857b6a872b5374ec7d3c971080244216", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "607fda11-04b1-4099-ab8b-99c5c4aa7cb6", "comment": "Malware payload (Dridex)", "value": "f9d6fbb0e8cb77782da4e54fa9f298ee2d161d50582d7fa7e62bd9a1dea1af3911bac6072e9018688ef079b0a569a831", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "c87cccd3-d5c4-410a-b0b1-06787a1df8d2", "value": "4C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "e279a118-a63f-46bb-8a1d-3c3e17211c54", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "cbbd77c6-847e-49a8-96df-9d3cb7c1b09d", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122992, "uuid": "3b8d448d-345f-4fab-8080-89df3f78d818", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122992, "uuid": "ef0c28e3-ba9f-41d4-9406-1bbc9da429db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "cb7d7693-b4c0-436f-b203-755d811559fb", "value": "70c7ea573fe33de3ac050fe5543f9a1b89443b2e66ddc5e01574d65f10cd468d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c4420e-91aa-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144844, "uuid": "0c8f87bd-0737-4e44-91f3-e95c476e343b", "comment": "Malware payload", "value": "836977007530fda00da1474af5e806f6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144844, "uuid": "bfdc3a4e-2d47-41f6-a2fb-623eab01eaf1", "comment": "Malware payload", "value": "7161d9916e0ea4964769343ec416105979cc127b0a57927b4b3dd7f2a7cbedea", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144844, "uuid": "d934901d-6868-415d-8935-19f540254a5d", "comment": "Malware payload", "value": "fcb587dd4865d87512241d07175349ec31151b24", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144844, "uuid": "bfd9900b-d275-4681-81a1-ee99fa205c4b", "comment": "Malware payload", "value": "930dc3bfc3e1bc1da08bcb613f5d60810c335cefda41090a37559cfee1c4e50b5a701e2a2f18dab410f43088497659ec", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144844, "uuid": "357acbdc-ab2d-4779-a869-d4433e530367", "value": "A114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144844, "uuid": "fc79baac-4311-4ec5-8159-4512f8e44b64", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144844, "uuid": "93fc5a31-d63d-467e-b65b-5db06f20d2fb", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144844, "uuid": "4751c19a-2b8e-4084-a4e9-8eeab4ed3d29", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144844, "uuid": "66902c56-8a01-4813-91ab-5496e1f97f0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144844, "uuid": "654b9b85-4e39-4c66-a90e-e4eaaca9b79e", "value": "7161d9916e0ea4964769343ec416105979cc127b0a57927b4b3dd7f2a7cbedea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e686321-9139-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617096061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096061, "uuid": "aa3f0aac-8f3b-404e-bbb1-580be7e68fe8", "comment": "Malware payload (SnakeKeylogger)", "value": "ccd73807b5c1ba5405383988e79c987e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096061, "uuid": "5fe66d98-71f4-43de-a987-c3933334bc37", "comment": "Malware payload (SnakeKeylogger)", "value": "7183c615991e77fe7425df22711166245d02ec6e997d57547eb6bb2d654ad1bf", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096061, "uuid": "54f3f78c-fab8-48bf-bed3-6f9a73bc42a9", "comment": "Malware payload (SnakeKeylogger)", "value": "bb279c7a68ce0da2f73affe2ef35c862ba8a58fb", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096061, "uuid": "e385a99a-0437-4adc-80be-86e63b0b16e7", "comment": "Malware payload (SnakeKeylogger)", "value": "f20abcac14dc9703e839399049026ec5060a055eee955d309bee4716f9863ea7238eabb8939abb6ca984975b7025053b", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096061, "uuid": "cd77bd5b-186f-4737-a05d-4c617cea084a", "value": "FB256D4C5B99C18AD5760A64C1D983F946A95EF2FB22CC6BA5C43FCFF5317C0A206263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096061, "uuid": "e3002dcb-156f-43f6-bf00-abf9b92f128a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096061, "uuid": "b7e1d93f-edec-4436-89cb-54a732ba397a", "value": "12288:P83ELYVDZwCZ+bF5wiDydgAP7SxAE5D9ntS5i6wlmPj:P8vZ+bF5vydjPexAE5DVQJwlm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617096061, "uuid": "eb2b4301-517e-48d0-8c4d-e4a3954dbf05", "value": 977408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617096061, "uuid": "3170488b-0c0b-48a1-a308-46d87c98d000", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096061, "uuid": "7b001014-9244-4960-b926-507d3175b2e0", "value": "ASB Swift Copy..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522ef4ce-911d-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617084068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084068, "uuid": "6377a5ab-2f36-4280-b771-15fcde16a835", "comment": "Malware payload (Dridex)", "value": "79293192213546f0935a5d5aa1a3ce15", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084068, "uuid": "1cdc0f7f-ca41-4876-a1c4-9fa2728d582c", "comment": "Malware payload (Dridex)", "value": "71a256031406659218e6e05446e0f86991610eed3e7cf200d0d369ecc646b01a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084068, "uuid": "0544212e-4552-4dbc-988e-b8727e28f988", "comment": "Malware payload (Dridex)", "value": "2a7fdd815652048276c146a0ba12d0dd69f769d0", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617084068, "uuid": "d3cba75b-1a5f-44ac-83dc-ee0981c4034a", "comment": "Malware payload (Dridex)", "value": "c71053705cf9d2fc075681254006b382ffc2a627edff9fd8b71344c654debb9f1e2f75156d49c18b459b6ca8a1077e4c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084068, "uuid": "4e848ee8-a28a-4616-b78d-f98228217d20", "value": "8914AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D164D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084068, "uuid": "45cefec7-7db2-48fc-94dd-6c6376c4009a", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084068, "uuid": "e1dd7f88-9c95-4474-bfac-c04795635dc1", "value": "3072:51i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:bi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617084068, "uuid": "d13b8c82-1f6f-445f-b6f4-5d5b8158bb51", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617084068, "uuid": "35abefd4-84ec-4cac-9138-92a6b14b5a4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617084068, "uuid": "aeba4710-9b99-41ab-8c19-577b90c54ac7", "value": "71a256031406659218e6e05446e0f86991610eed3e7cf200d0d369ecc646b01a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d99dbad-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121856, "uuid": "43a58075-6ae7-43b5-99a7-4f2699f9c53f", "comment": "Malware payload (Dridex)", "value": "abe5abfb0ed27fe3a3147323b8778d13", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121856, "uuid": "a09fa90c-e3c7-40ec-b331-007fa8fdca44", "comment": "Malware payload (Dridex)", "value": "71e8022a6ffa0f551794b3e5c396e9941bbba2db97ec9f5d64acf6d6860cff53", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121856, "uuid": "41c220a6-5d65-41e8-acef-9874a78bd3bc", "comment": "Malware payload (Dridex)", "value": "76497503a7ef57ce3146c830d8c1d34064f4bab4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121856, "uuid": "85395eac-ff27-41d5-81ff-cca2505d70da", "comment": "Malware payload (Dridex)", "value": "c1e2cb3996c37231ab2284202f8ff2c3fd7d376fca49ddc5027f8c29ebfa65e3381d6b7f61a3a4133acc287aef0d9d3f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121856, "uuid": "105bf6da-e516-440f-bf02-dae4c7fd23e3", "value": "8914BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121856, "uuid": "aee3a282-72ef-485a-8b5f-2e53ab37b23e", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121856, "uuid": "d9430191-3925-4a26-9482-6ec57e471ab1", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121856, "uuid": "ef67447d-21d2-44a4-a72e-b8ce72816e51", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121856, "uuid": "8c972189-987c-432b-bdc0-e214972201a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121856, "uuid": "9ac8bcb2-d0d2-4823-af71-69766568e643", "value": "71e8022a6ffa0f551794b3e5c396e9941bbba2db97ec9f5d64acf6d6860cff53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4c10d0-9193-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617134873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134873, "uuid": "6c77795f-4ce2-4fcd-b1b3-c89ea2c75e3a", "comment": "Malware payload", "value": "b852fd6e5c5738f8bc223eb46fc16c73", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134873, "uuid": "dde6e3f1-33d3-436f-8a47-78da230204c7", "comment": "Malware payload", "value": "71ed77e640ca464498842349fc726aaa70059c5e22559c914c8400a5a68f1587", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134873, "uuid": "40b06667-3178-4f34-bc20-f85d8719be7c", "comment": "Malware payload", "value": "68aaa164a30c11935f2d19cbffe27b9fbc498c4b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134873, "uuid": "910d757e-9911-4a9a-8d5e-2f08aec97645", "comment": "Malware payload", "value": "3d51e9552e0b2fdc7c479b25c657d66db7b7ecaf65e8b9ed7c1b4ca9abdffe06b06fdc766483abbe89705b7743e51f12", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134873, "uuid": "61885e71-d7e0-4c9f-a32b-16cac2b9845b", "value": "0F14BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134873, "uuid": "59e283c2-de44-43a3-868c-4abcc499792f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134873, "uuid": "340d1dac-3da0-428e-9546-9426b36d3def", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617134873, "uuid": "275706c8-fb99-419f-a542-ac3a1bdc8a7d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617134873, "uuid": "39c7d781-5770-4d2b-ac5c-7105a3be9c2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134873, "uuid": "f332c34d-7ffe-448a-98ff-41d01fcc627f", "value": "71ed77e640ca464498842349fc726aaa70059c5e22559c914c8400a5a68f1587", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b71cdc0-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114953, "uuid": "48507ee7-f57f-47d2-91ac-a07fd2778caf", "comment": "Malware payload (Dridex)", "value": "ec1a8bb755ff89851efd217fc2cec9f0", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114953, "uuid": "b5e0aea2-7d58-4245-834f-15ac4f1ca370", "comment": "Malware payload (Dridex)", "value": "72352174902da5103ce63ddea81b6d379d25d9bbd4fb1561ff29ea8229b258ae", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114953, "uuid": "2aa89570-acfd-4f01-b1ab-10803aaa85e5", "comment": "Malware payload (Dridex)", "value": "ba2770f98b5b71ad94ead2e49fa57339e65d8d94", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114953, "uuid": "c2bde0be-f35e-4bf8-81dd-5ac725dcd4d5", "comment": "Malware payload (Dridex)", "value": "2d6368a8d65e5e7800eea0deb010da5c695d5b3884437b597cfe33e028fb794f5843c83bd7a4671f75e51cbb643e13e4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114953, "uuid": "321be1ad-fe53-4013-b588-4305dc213c43", "value": "E314BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114953, "uuid": "7c7b5844-9baf-49c4-841b-384beb282ec9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114953, "uuid": "2e1b936d-507b-40db-b907-887855cae02d", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114953, "uuid": "b3cb9d0a-93f6-4830-ab86-4b91b2fe4b1b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114953, "uuid": "fa2ab1ad-f99e-4808-91d7-731279906425", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114953, "uuid": "371c4a64-cdd9-400e-b9a8-6b12e0750e86", "value": "72352174902da5103ce63ddea81b6d379d25d9bbd4fb1561ff29ea8229b258ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de0fd63-91ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617146042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146042, "uuid": "01b2b293-00f6-408f-b57e-44eaa115dd7e", "comment": "Malware payload", "value": "829411439cfa9a00422f6fc949c65f56", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146042, "uuid": "6a67c639-c716-4c84-8fa3-df501740e9e9", "comment": "Malware payload", "value": "72f22704ca588aeadf656591a13f6fa81ae5aa1f0acacebcaead513917aa7ba4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146042, "uuid": "33d46c3e-d653-4bcf-a161-30f73cf6d71c", "comment": "Malware payload", "value": "938a62f7076ed2dc82a0bdce4e2ec44396420c65", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146042, "uuid": "215d090a-7063-416f-91ad-86c09337a95d", "comment": "Malware payload", "value": "929682d75bb2ec8999164fdfdc1aeb977b32fee9e9c089f2fe493341b96508829d9bf4e50cbbc5a591d277d2902aafb0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146042, "uuid": "63c1237b-a643-46da-8a54-3d3acc38f6e7", "value": "C414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146042, "uuid": "f2aa1db8-2ee5-4bad-a7d5-041e311045b9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146042, "uuid": "8b5ee70b-5a7c-4af0-b6a5-5ff738b7ffd1", "value": "3072:E3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:gJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617146042, "uuid": "dc748b54-c5e6-4664-8033-5490613f0511", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617146042, "uuid": "8cb1bd74-01d6-44a4-a184-9068f98ee012", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146042, "uuid": "69598eca-497b-4dea-b316-a97fb929d41b", "value": "72f22704ca588aeadf656591a13f6fa81ae5aa1f0acacebcaead513917aa7ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6924076-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127186, "uuid": "fc5fed6f-61e1-477f-b65d-1a9f88dcbf1f", "comment": "Malware payload (IcedID)", "value": "0f66561f958402724edb602d64914d70", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127186, "uuid": "1a596522-7641-438a-8c97-e53b1f869055", "comment": "Malware payload (IcedID)", "value": "730bdf6bb7d22f8e0bd58c7156fb0489ccd913c16095e853ca3e48656f4ce3b9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127186, "uuid": "d61b031e-fcc0-4ffe-b924-58a278484ec2", "comment": "Malware payload (IcedID)", "value": "c42a2fe300429ad99db7d1884cb3b4753ee6e618", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127186, "uuid": "79f32782-f7c2-49a1-a047-bd2a74e8366f", "comment": "Malware payload (IcedID)", "value": "96ee6fc37708bfe83b8a5ffc2e03272f52b9bd3ad93ceab75bcfa77dcb9d55814a95a86b5274ee4ae3172cb5583af3bc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127186, "uuid": "17e7a791-fe41-4d94-9f49-748a3553cca5", "value": "4EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127186, "uuid": "21cdf186-0634-49c2-899a-1b6f90cf114c", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127186, "uuid": "594763ed-7bc0-43dd-984f-176b6455cbfc", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127186, "uuid": "93812c32-d363-49a0-b94a-bbe712064c4d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127186, "uuid": "fe952de5-1f11-4611-83a5-3083783b7ef3", "value": "document-1230806529.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8519b23-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617088185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088185, "uuid": "cc5dd290-416b-49b0-9e1b-50165f835afa", "comment": "Malware payload (RedLineStealer)", "value": "8a888b88835e506767ebd8e6dcf9f666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088185, "uuid": "0e67b8ed-dc19-4127-ab83-793f4e5fb9ae", "comment": "Malware payload (RedLineStealer)", "value": "73188b6122dcf35a0d26fedf3679c9713e6f21ccf78499d8788ed39feb7fdb4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088185, "uuid": "182cbdca-6094-46d5-96c2-9772a7a7177f", "comment": "Malware payload (RedLineStealer)", "value": "c0f9f7a499b85a39e88b95fc11d2e439b7901735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088185, "uuid": "5be9bd53-eb73-4914-a68c-f3740c0a0165", "comment": "Malware payload (RedLineStealer)", "value": "9e4300d5ae6ab11d3e818f1045780813bcb3e1cc1401bd085b5ed8290a4586d67e59d72e7485a6456f3c032ee15f2bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088185, "uuid": "57b28359-ae7e-434c-be52-e2f08c5ebd53", "value": "47C533223686D849C600AF329D3DEA1D9A224F9854D5BF2037747A373EBFC459C2B19D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088185, "uuid": "c7aee8e6-72a9-4f84-82f0-24dc1dc18666", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088185, "uuid": "3b556490-0a8e-43bf-9ae2-3f9ffbec378e", "value": "49152:1q5Hh+Ja1ecQlcYlL+35uALXmQJOm/XcMafV8bl+ycVwduVQDHIGJYd7nJWmbo8h:8Hh5eXlcj3lUlqblbJuKDQnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088185, "uuid": "96903587-cd7f-4618-ab5e-8146e484336f", "value": 2601503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088185, "uuid": "d9b26af2-1043-447e-8d66-f802726673ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088185, "uuid": "e7b934fc-c783-4386-ab7f-20936685ca7a", "value": "8a888b88835e506767ebd8e6dcf9f666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa93776-9194-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617135273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135273, "uuid": "19eb0bf9-9417-42d7-9b2e-7b598597bf92", "comment": "Malware payload", "value": "28a3c2c522c48514d207c0b478cfc422", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135273, "uuid": "c75f59cb-2977-4832-be27-d7dc0c1697f3", "comment": "Malware payload", "value": "73444d3d63ce48f02d1882772e1b97f09be1585060d7c4a949cce96fbfc5c6b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135273, "uuid": "ecb6ba9d-9018-4faa-a68e-995aac773f6f", "comment": "Malware payload", "value": "ac9dc4ef0045fa0d03a1c7bb115f8a47f8c45bb3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617135273, "uuid": "ffeee152-fd10-4937-8928-6c43baacfe11", "comment": "Malware payload", "value": "646fcdcb5d4f73288b67c26901a610b3262d24ec0b45e7c4d4c7494d6fc789739d4837ead5362b3047394b0a9b0b25c8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135273, "uuid": "840022de-569a-4500-9f46-2bf393f61be2", "value": "5E14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135273, "uuid": "5cb224d0-8c7a-455a-a870-61fb3ce86a94", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135273, "uuid": "89f51966-4060-4460-ba31-e7c8216bcc6c", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617135273, "uuid": "617b0b3b-ab3d-4192-b192-90078795319e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617135273, "uuid": "f1747f89-5c26-4cfa-b010-8c76463d7ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617135273, "uuid": "8e75a894-f2a0-4384-8012-3816b107a3cc", "value": "73444d3d63ce48f02d1882772e1b97f09be1585060d7c4a949cce96fbfc5c6b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3a350e7-91a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140469, "uuid": "e4d38d2c-5fd1-4c2e-a7b4-c587989116f3", "comment": "Malware payload", "value": "81bf5c64cfaff3c62cfcf70cf4c674c5", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140469, "uuid": "f4af856f-969f-4b29-b3a4-11f963269d67", "comment": "Malware payload", "value": "737d73c654f40daac6a65e9968d87623ff2ba477b9bc2209f5b19d3baf8242a4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140469, "uuid": "f1128380-6c8e-4fdd-a439-4d4e4afd0a15", "comment": "Malware payload", "value": "a8feace2435e50fda8d06b846aae57595028b37e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140469, "uuid": "8647d030-465b-449a-b4d7-9d66e616ab52", "comment": "Malware payload", "value": "4fc159c3e98bbc4ec00525c5a96b11611d976df87b73c5146afa7524b35371ddf0ad4e790f5fdc4596c09aae8b3840a7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140469, "uuid": "cafe45b7-79bc-46ef-b302-3782653110b1", "value": "F114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140469, "uuid": "deb67573-3d26-4d63-8d42-bb0136babba8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140469, "uuid": "e48b7a70-1b41-4d3c-a881-617e1f016b9f", "value": "3072:A3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:EJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140469, "uuid": "9a0b9b5a-49b5-43bc-95c8-a0c62d3cf28d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140469, "uuid": "514367ad-bf81-4deb-a7f4-5ba0cbe07734", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140469, "uuid": "2f42428f-20af-4300-81d5-5ade3093e0e8", "value": "737d73c654f40daac6a65e9968d87623ff2ba477b9bc2209f5b19d3baf8242a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499544da-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115407, "uuid": "2362e4a0-5cbc-4a16-a4ac-dcd5c43d95c4", "comment": "Malware payload (Dridex)", "value": "ca48de2b534965e9aa7493f12153051b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115407, "uuid": "750e4d7b-be6d-44b8-97cc-8997d9eaf554", "comment": "Malware payload (Dridex)", "value": "739ebabf03472ad4b2170cdaf490d9ff788acf6a23d68c003eec8791973a53ff", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115407, "uuid": "b6d10e26-3b5e-44cd-a998-976ff8a7a2fd", "comment": "Malware payload (Dridex)", "value": "2958b508ce681128993e2b49e8c2f04700892fea", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115407, "uuid": "472c6af8-bc01-497d-b3ac-caa9809f8561", "comment": "Malware payload (Dridex)", "value": "86e26e4722f50b2b16138ff6687b82c4076cddb735688c286c40374e066ec82f99f7264e382cc249a74ad083d546fc56", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115407, "uuid": "d33d11bd-c653-4ddb-90b8-1ff8a85cf64a", "value": "A714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115407, "uuid": "1af3a47f-0edb-412b-95cd-4244b02702c5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115407, "uuid": "deaff91f-b263-4c77-999f-5bd950b18f1a", "value": "3072:G3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:iJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115407, "uuid": "4620a4d0-75cc-468d-9918-eaa87048b35d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115407, "uuid": "9c129ba1-34b6-49a3-817f-d5b440b2a758", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115407, "uuid": "f9039aba-51a6-434d-8759-ed0e154785b0", "value": "739ebabf03472ad4b2170cdaf490d9ff788acf6a23d68c003eec8791973a53ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8bc8a7-9159-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617109988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109988, "uuid": "b099a195-0b48-4b3f-b2fb-49e1cf30d158", "comment": "Malware payload (Formbook)", "value": "1ba4ead371dbf470be6b65f4250ba59a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109988, "uuid": "93134bda-48d8-4fa8-a20e-1597737000a7", "comment": "Malware payload (Formbook)", "value": "73ae89271f0a8b29a7711f16a075da38b088b3750ed29797ff5156d5569d69b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109988, "uuid": "2565815f-92ea-4d8b-b331-b060803b07a4", "comment": "Malware payload (Formbook)", "value": "5e9d33a1831b946e1e4a10646bea30d98d435d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109988, "uuid": "d53538a5-5221-48a4-9168-76b08500814c", "comment": "Malware payload (Formbook)", "value": "94003bfd3c35f836f8ab2dbf7e826253b0e5dcf9d313be8a4ade6a0823a4ac245000228d45860da374b4104b64d9a0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109988, "uuid": "09b0ee1f-3779-493d-b722-1687815ab2ef", "value": "CF9469C5EA8055A4DC19AB706A36CD3552237EFDA834A42D29DE3E2B3FFB2D31025057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109988, "uuid": "a4922be6-efaa-4949-94a6-f06be4121c16", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109988, "uuid": "23d2d3da-5168-431c-99c1-5f16e59c7a4c", "value": "12288:eP7r9r/+ppppppppppppppppppppppppppppp0GzviNC276LqLOR6c:e1q7iU2OLx6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109988, "uuid": "3f4bd130-960f-4af6-b545-5fb44632e51f", "value": 432592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109988, "uuid": "5d2a0011-606e-4b04-bc61-ff2fe462123e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109988, "uuid": "00383342-36eb-446e-94e2-720ed31a748f", "value": "JRTpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a626d0-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108558, "uuid": "e4f4d673-df29-46f1-ab8d-094244661938", "comment": "Malware payload", "value": "4e89e75fdf81f809e725635cd2b8e2e8", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108558, "uuid": "085cfe99-5ce6-4f1d-ba34-3f41f726137a", "comment": "Malware payload", "value": "73c639d16e7eca0f98fcf9a5bd2f60307e4f1bb033ee8e061f48f9a2a89bf6fe", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108558, "uuid": "896d730f-ec70-467d-8fdb-56440bd76a9b", "comment": "Malware payload", "value": "d0ca058c02974f5967db64b3e993823ab8ebccb2", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108558, "uuid": "3142ce48-7723-4b74-9eef-1b210d7363aa", "comment": "Malware payload", "value": "8e3867e5ceeff272702a83f4b1d47328e9134315bfb655066de22c1962bcca778fff27befa13f16da6f4fa65a8813698", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108558, "uuid": "060b6ba1-db09-4b94-9dd2-c5e3d638c592", "value": "0B8312523A896CF4FB82D9F378C07760BF63E68CDF05B2695033A529F266A5520D360D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108558, "uuid": "de943317-0a26-4c79-b4d3-f903e922cfa3", "value": "1536:ehDHtoPxSKTj5hG5sabgD9F26znfWoyDxcESSzDNFM8ygRm77IrWyESBqD4R:oDMXj5hG5saMD9F3zfGieVCVgALyEp4R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108558, "uuid": "720f636f-b022-4072-b146-f3af251d6b13", "value": 87197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108558, "uuid": "101231a9-d537-4614-9495-11ec4f966adc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108558, "uuid": "978d0d09-b6ba-43ed-af76-759618419f1b", "value": "impr_1222.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d66c697-919c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138740, "uuid": "916b04ce-5783-4ec9-ae55-67378e3630fb", "comment": "Malware payload", "value": "a01155cc0ac6da21188ac1dc67cfd54e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138740, "uuid": "8c7c74e4-bd63-4935-8cee-b093c767a9ba", "comment": "Malware payload", "value": "747f44561e889eaa27d686247e6bea016c5060418661d1498e551b6cf2c15d35", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138740, "uuid": "1e85cb9c-32a3-481f-a544-f5df4cb03efa", "comment": "Malware payload", "value": "d5d2b627d64ebe5fd71d958a279f741eaa3c786a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138740, "uuid": "886d89eb-3ff1-4c32-81a3-1dcc75515dc1", "comment": "Malware payload", "value": "8cf021902e638b93868e1a42907af75ce49d49f03bd77fec51ca70e0668fcfb48659b65eb45a1cdcad5f35de4f9f277b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138740, "uuid": "f9ccd372-d654-4bba-b94a-64e413422886", "value": "A014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138740, "uuid": "70e11490-6897-4111-943c-cfc288d70b2d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138740, "uuid": "2afa1921-7245-4cf0-bc29-96521c5aa71f", "value": "3072:Z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:RJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138740, "uuid": "0d48ebcf-9ab6-40d9-9447-82dedfcaebe1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138740, "uuid": "f975c563-3841-4593-b68b-976fcaffed54", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138740, "uuid": "fa64c931-9c65-4ec7-bafc-95a82fb9e5d4", "value": "747f44561e889eaa27d686247e6bea016c5060418661d1498e551b6cf2c15d35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95728980-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108662, "uuid": "f174919b-5952-48a3-a3a0-481081e65ba8", "comment": "Malware payload (Quakbot)", "value": "ffdd461c52a57102740b3ccfec9a4b5b", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108662, "uuid": "6d26b3c6-f0be-42d0-b276-71ca52847f97", "comment": "Malware payload (Quakbot)", "value": "75798031500c5903fb5b84db6bcb1347c361b799640be2734189cdc7ffa3dcb2", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108662, "uuid": "4811924f-e1e7-4931-a7b6-640866c8f488", "comment": "Malware payload (Quakbot)", "value": "9c5c775fc06b65b86c314dfad1ee9da24824e785", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108662, "uuid": "26c8a024-4a6c-4cc5-b0b5-914c81d89850", "comment": "Malware payload (Quakbot)", "value": "75a2bfaa27c6c5a80bed39bc7f3de38d82ad23cdd63c48a63020884e398321e4296d118beec3e28307e1378d8237b9fb", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108662, "uuid": "d507d1cf-1f93-4ebe-83f1-dd7ccad239b6", "value": "D9C3DF5DA294B06EC39FB43CA702A8E25D852046E553B17F35B07E0C66AE2D71F9F09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108662, "uuid": "7375c9af-33e1-4f33-a4b1-d1e172ab72aa", "value": "1536:Zt3yZ7H88WWMHIz6oSvKmUKc/ROiuFhXV4Tv7xVMsigZEQNggMorCK0oF:Zt3yZ7cQMHIzkS/TdV/vEQSlcCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108662, "uuid": "10e15e3f-9fef-47e6-b9bc-9f14c47440f8", "value": 123256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108662, "uuid": "103eda0d-84e0-4996-a4ca-f19c69a859b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108662, "uuid": "36491dbe-d252-4d29-bb71-38e4858d0a99", "value": "licenza_1267.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d550a87-9186-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129237, "uuid": "26616555-6be3-4edb-bd46-2605988c92b7", "comment": "Malware payload", "value": "3e156dafb32e3914dc48ca67a49e501d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129237, "uuid": "b6286ffb-534e-4cd1-883e-d7dbb879b30a", "comment": "Malware payload", "value": "7618750ce45d1630abd7a10f028c5a8fde05173d3441c614dfc73f811f2645b5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129237, "uuid": "b8e4b7d2-107a-4876-a614-e0597b7ee3ba", "comment": "Malware payload", "value": "d66b6efe9507bb23a6d26771443aba22ccc32d7e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129237, "uuid": "c2d1bbeb-0299-4cea-a146-07ed2296ee50", "comment": "Malware payload", "value": "544328572d392fab9640b51774efd2071c6b0db983b97e8b00a0de3b43385a4b0803ffe391f15cdb94716e31f2f5d274", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129237, "uuid": "74583831-e839-4d7e-93ea-f32532088d1f", "value": "2614BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129237, "uuid": "57d04779-e955-4761-a044-39d0756d3c08", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129237, "uuid": "767c89a5-0355-4d4f-b1bd-7680abec3b43", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129237, "uuid": "b465492e-26ef-4f24-8a6e-6bb3e623e6e1", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129237, "uuid": "3d6f0cdc-f3a2-482f-a6e0-52ce3ad7d40d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129237, "uuid": "da51a940-6704-4719-93e4-1cebdb4f7665", "value": "7618750ce45d1630abd7a10f028c5a8fde05173d3441c614dfc73f811f2645b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f49bb8a-9119-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617082291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082291, "uuid": "2a26565c-0b69-48f4-9d68-5df0a907bc60", "comment": "Malware payload (NanoCore)", "value": "be33bca6d0f5559613bded9b0332c23e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082291, "uuid": "d6d79a58-3eaa-4e5f-bfd4-d10fda2cee46", "comment": "Malware payload (NanoCore)", "value": "762026c5c92cb85488ee728a0641d1c57200dea3b22261c671692e4cf5d32342", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082291, "uuid": "9b638dd8-affa-497d-ad77-6c0dc021d289", "comment": "Malware payload (NanoCore)", "value": "b7203cdfe34e36e953a74d8f0dc69964c5421fc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082291, "uuid": "cc1b6fcc-6c6e-4eea-89d9-17f9733fe2f4", "comment": "Malware payload (NanoCore)", "value": "269331c0386e7e64c435618908a53cd33c336bc7b1cf9ca533f8074e092e003451fc6813b467c4d0d5e8c7f409d5296a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082291, "uuid": "05600df9-28df-4eb4-8bae-4707fe414019", "value": "2FE490A870AE005DEEB46B34F5B555821FC925321F62FF3F28E657006CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082291, "uuid": "d95919e6-9ad8-40f7-abb3-b723964b6614", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082291, "uuid": "c0f9d3cb-8600-4bf5-8033-c2dd1403e432", "value": "6144:CaLDdj7dO60VKEBMO71nZow55ghLj6h3/oLAm5YrS4WcEwvYKQm0umL7dov2wXsn:RjppE3s5WG0mNcEw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082291, "uuid": "13abb353-40ae-49c6-a4cf-2c82238d1bb7", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082291, "uuid": "3329d0ff-055a-48c0-952c-35e35ba4ab2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082291, "uuid": "79aaa3dd-7647-4221-97c8-922847da209f", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db0fd94-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143680, "uuid": "47c678bd-e72a-44c9-975d-0a45496dfe62", "comment": "Malware payload", "value": "b0500b304636396f539993976ad58a57", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143680, "uuid": "66d9653b-2c80-4063-b90c-df7ec0d5dff0", "comment": "Malware payload", "value": "763f6eb8a2798e78bc67b61a31c595e23994b27e648ab4752c957f00e4456cd9", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143680, "uuid": "c11abe03-3077-4fab-a615-100aa6f30b23", "comment": "Malware payload", "value": "bb61b9a6c8c8dc8e0fd7dc7c30e258923dcc15e0", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143680, "uuid": "8e3893af-e195-4fb7-a1d8-99dc563b41a1", "comment": "Malware payload", "value": "e4de2b2c19df0e0db1d7b3eab977679ac59cd73f521c508e91688285e3a24aa3d74ee57e0f3d24bbc67c4f88750d02d1", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143680, "uuid": "1a637e84-d6a6-4be6-a1d7-d2eb12d99b11", "value": "98C4AE12A5629039F9B347B689FF594941AEBE90073464CB73C8996D5B7BAE03F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143680, "uuid": "205946c5-2efa-40d3-a2a3-e7983cd9a5e1", "value": "adeae1388ccab7d5ea2c08a636428844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143680, "uuid": "2987d418-8fb9-4aa0-b3ce-557cdb29d5ea", "value": "12288:wbHAqgIuNsQBUoGlXA21Sp3vykrYIYtUfd+G+NkZ:sBCNrUZ/CakrYQdZ+KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143680, "uuid": "fc6db143-d070-4964-84c9-4a4c18f75004", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143680, "uuid": "681d321d-0fa6-4bce-9ed8-c731042d5d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143680, "uuid": "0adb30c4-b1a1-4eec-89eb-5d04cabe0560", "value": "763f6eb8a2798e78bc67b61a31c595e23994b27e648ab4752c957f00e4456cd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b45b23-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122484, "uuid": "95de860b-2f03-41c9-b7d9-c0cb68cfc981", "comment": "Malware payload (IcedID)", "value": "ed53de3ead3fa86540c93e0f909a174b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122484, "uuid": "f8356d2e-40d8-4917-bad3-69c5cd1ea5f9", "comment": "Malware payload (IcedID)", "value": "764a93aab1a8b446f7086a107af166059935daa3ee803431d89c567df372d04f", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122484, "uuid": "6017a71b-a3d3-45ee-bad7-972c3d613869", "comment": "Malware payload (IcedID)", "value": "2cf9a337636ac74dfc74f556e5e2ef25df83febd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122484, "uuid": "63c3f248-e554-4e28-9df9-05899c4c9878", "comment": "Malware payload (IcedID)", "value": "fb7205ce33514005f62aa0988e95509e963480c72ae4424e28c4d24a212f75ebdf625fbc30ea126de051017745208257", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122484, "uuid": "47503a48-c552-4e31-844d-9c36966aad81", "value": "05B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122484, "uuid": "521c984d-65e3-4b6c-aa74-25002717363c", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122484, "uuid": "0d85f81c-d90a-44e2-86f5-8aa94d690d38", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122484, "uuid": "6dbe5de8-be93-4f7e-b79f-a83c7c5e6c03", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122484, "uuid": "d78eeb9a-29aa-415f-94df-1e0d50d77fcd", "value": "document-1717105641.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411e39c6-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "ab73147e-d0be-4cf2-a38a-737ceea27071", "comment": "Malware payload (Dridex)", "value": "c383ab6557b3f24876d35dec9ef6dc0b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "22c67b1a-cbdd-4b40-82d6-f0139d447d45", "comment": "Malware payload (Dridex)", "value": "76e737d411c507cde0a818abd566432bb4c8f4af3bc5ee2d3e7276d273e4281e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "6a1cba01-5962-45f3-ab07-64f6dc7d86a2", "comment": "Malware payload (Dridex)", "value": "a56d5d5844e1045e48be2ea4cd7d807bc442da44", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114104, "uuid": "647098fc-acc0-43a2-a9f7-a1c38e896902", "comment": "Malware payload (Dridex)", "value": "fa1b29508d6a92480e4a0576c817d925e9e9068df4cae8e206d75c5e51dd7d338470ea54d77eabd9156e7527e1cc6eeb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "057ea396-0429-49bd-b392-60b939f1efd6", "value": "2F14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "238e5a57-115c-42ee-9bbe-18f48bfab37a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "1329d55f-22fa-4605-9685-c303f91efecc", "value": "3072:k3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:AJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114104, "uuid": "3c7a62e9-bec0-413a-aa6f-51060f719679", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114104, "uuid": "0d9a180b-4068-4d8b-ad41-c8824dc9fa55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114104, "uuid": "07252465-bd5f-46a9-a494-7196cbd83d49", "value": "76e737d411c507cde0a818abd566432bb4c8f4af3bc5ee2d3e7276d273e4281e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed529f1e-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122983, "uuid": "d0965c2e-1070-4df6-8198-48b7d2ca78b4", "comment": "Malware payload (Dridex)", "value": "66d703f81ffdfeaf308be9ac901838db", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122983, "uuid": "810e01fc-8ec3-4e90-825a-792c5345e1bd", "comment": "Malware payload (Dridex)", "value": "7738fc256a461f0f3ccd2f552f8acd72a6afa75702c5804cc05684818028f686", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122983, "uuid": "bcc4e085-ffab-4b9f-aef8-9bc6d3e6376b", "comment": "Malware payload (Dridex)", "value": "6acf4b19fc44459bc442f436774ae476419cbe23", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122983, "uuid": "06eff9e5-3a19-41ba-8207-ccb2e3a203e6", "comment": "Malware payload (Dridex)", "value": "13893e989232bc440d56edabc4d6ecd6296b703ba4ffcd184c509ddc9d5f897ecb4633995b70ebb73026eaa16dd985e5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122983, "uuid": "1dee4810-ea39-41dc-b385-1ffe47bb2b6f", "value": "2B14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122983, "uuid": "6037e539-6180-4b0a-a5d3-21879ab4c716", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122983, "uuid": "3420e697-80f0-45d0-818b-6ce14700702e", "value": "3072:B3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:ZJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122983, "uuid": "b4adb2c9-00a0-46f9-a883-2df01bde90fa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122983, "uuid": "119db830-ea15-4bcf-800d-3590798bc4c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122983, "uuid": "7ab8475a-4fbe-4c9f-a049-5151a89bd478", "value": "7738fc256a461f0f3ccd2f552f8acd72a6afa75702c5804cc05684818028f686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d5ad82-9183-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617128119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128119, "uuid": "d1f1050d-69dd-4cc0-9c39-6bb158029726", "comment": "Malware payload", "value": "6c823b4e07280638aa73e0d609971e67", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128119, "uuid": "be7b1595-e9c7-4bc2-a568-347800149d8a", "comment": "Malware payload", "value": "7740d441afd42e2931183b50b4ba715e522d8d523ac84a43cd558a6f20b521b1", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128119, "uuid": "1d107ef9-d9ad-4152-9a46-1a7ed65c2de6", "comment": "Malware payload", "value": "bc8b39dfc63c064dd1afb08183acf9fec855c1b6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128119, "uuid": "74b2c439-f664-45cd-881d-0f8c9ae4edcf", "comment": "Malware payload", "value": "cf31958c69e9f43be85c04ed9099db8722445bae938ea7d700845f5919eb3e433eac38b6c6966235ed325146162713f2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128119, "uuid": "7af207e1-73df-46d8-b1c7-e1eeeb855348", "value": "5514BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128119, "uuid": "2a883af7-f37e-4290-95b8-16d843badae7", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128119, "uuid": "6f01a575-dd65-4940-b826-b7523bdcc607", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128119, "uuid": "e0dd637c-825b-4906-b16e-59f0dbebde25", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128119, "uuid": "4270ed9d-3b36-4050-89ae-b36839e53ed4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128119, "uuid": "b47b5451-6470-4927-b309-019cf753042c", "value": "7740d441afd42e2931183b50b4ba715e522d8d523ac84a43cd558a6f20b521b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64129265-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120605, "uuid": "49e9bc8f-84dc-46bc-aa65-af195abd8b04", "comment": "Malware payload (Dridex)", "value": "6c2b83d3fc4843e8651dc8cb6e913504", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120605, "uuid": "b011818a-40a9-4ecc-8b0e-4b9ea0c1c84d", "comment": "Malware payload (Dridex)", "value": "77476960462f870b5e737859a48939ac0eb4544cccc75de8899e295d4ec39465", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120605, "uuid": "00343948-c4c3-4fbc-9486-6c915e8ddb02", "comment": "Malware payload (Dridex)", "value": "50ae49216272a55b5bc327aa1d1eb57f11c4cca7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120605, "uuid": "97602fea-be6f-4082-845a-3881577f9556", "comment": "Malware payload (Dridex)", "value": "97711c77fffb5defc10659125b44700caa90f0f1c26756289eef8365237479b60bd00535ab99af69faa508822ee2069a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120605, "uuid": "e1099da3-5c56-4ee1-823b-be37e7d04fbd", "value": "E614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120605, "uuid": "fa2247bc-f5d3-4625-b05e-1b56c20b058f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120605, "uuid": "00b60989-2dfc-4aad-ad02-4772ccedd02e", "value": "3072:q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:OJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120605, "uuid": "68cbac31-a9d4-4810-a19a-2fb83033c7ed", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120605, "uuid": "eb33aeca-4538-485c-8f17-15bc3c7eb932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120605, "uuid": "69507019-7641-4d2c-b3f4-3039b8de7cff", "value": "77476960462f870b5e737859a48939ac0eb4544cccc75de8899e295d4ec39465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd2f4d2-913a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617096546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096546, "uuid": "fd62aff1-4d1b-40dd-90d0-3be5a0b23f0b", "comment": "Malware payload (AgentTesla)", "value": "ec8faa0501e8e21b3f6dd5e245f1279c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096546, "uuid": "6bfcd261-5ab2-4c80-b13b-f88cb1ffaee3", "comment": "Malware payload (AgentTesla)", "value": "78213a844b4ba9c0b19ca285f82d8591c84a416ea596be9f5b1c312e0e3ef3c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096546, "uuid": "a70950b7-9626-4e8a-92ed-044b17afeaae", "comment": "Malware payload (AgentTesla)", "value": "c15b09810c7dfc668303af1ce51b58cf776a6072", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096546, "uuid": "d3592650-7a51-4992-859d-ebcdba63ef95", "comment": "Malware payload (AgentTesla)", "value": "0e17da34063249b69d461bddeef7963821b1c9443a551eb78f7ba351e3e94ce788a40f15645d7ebc5e1fa080e006e8be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096546, "uuid": "85e26281-a946-471d-9751-207dd03e0944", "value": "779423638236EC68BA2E7721DD6FC1F735C5961038B8A60C0676F69491DD67CA6C802F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096546, "uuid": "8f6d9952-bc37-47cc-a4e7-0ffb67c47712", "value": "6144:iI/+ceMsaKPheR+WXSq50AxD/kgcPqZI6JWqWpSDEjj0U91YSjYyFM2RE4SpI:HWcbK5WC3AxLk+ecHGj0U/YrAM2C4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617096546, "uuid": "4ffaf0c5-a571-4b23-abfd-641de9b1af1d", "value": 445034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617096546, "uuid": "d371f18f-d4ea-41b6-9a5f-0987cddb2c0b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096546, "uuid": "814aa53d-672a-4a11-a455-53c7fa39352f", "value": "TT Swift confirmation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d97efbd-9139-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617096059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096059, "uuid": "e3f02bba-f6ba-4164-b9c3-3cdc02dc79fa", "comment": "Malware payload (SnakeKeylogger)", "value": "21c148e7dc4b03b933186a6173dfbe20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096059, "uuid": "c0ef309e-ed91-46a1-a705-8c6603e4a4c1", "comment": "Malware payload (SnakeKeylogger)", "value": "7829b640c127541a9aca45739ad54b16d2497aa3efa7a3870f33ca8fd095c610", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096059, "uuid": "c0734f72-74f7-4db2-9a53-3597e8a1fb4d", "comment": "Malware payload (SnakeKeylogger)", "value": "6074a6627aa4f2faf4987dd497a6a9cb63a9e641", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617096059, "uuid": "ae0254cb-469e-43fa-8817-ef16a342aa78", "comment": "Malware payload (SnakeKeylogger)", "value": "f6d799ecac72e345843b0745762da6de07b214eba96dbf4131371b2f9ba43d4eb3790c5f46b8c0817903b24219b15d8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096059, "uuid": "ca48e979-1ef5-4e96-bf3f-501305f48126", "value": "BCB4238D40A071DA9FD11F96FCA6981E2EA0474FF7F4D0AA52A47C9E57AEC64C187CC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096059, "uuid": "32a76dab-54c7-45d1-9372-23ab1435944a", "value": "12288:sYhdCgamAwnAO/VbFuSc6A+WH0CmG0HfD9rtqBiemXnO:dhdpfVV/VbFkh+7CmG0/DFiAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617096059, "uuid": "6ebf491b-b254-4ce3-a745-63adaae257aa", "value": 515471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617096059, "uuid": "7c9e509d-cb33-4275-a273-ec3fc8eeeac5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617096059, "uuid": "41e73253-7fa8-40d1-9e57-a1d6d324b6ac", "value": "ASB Swift Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b45a92-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085423, "uuid": "63a5bb61-bba9-49e4-8a9a-59a25df153c0", "comment": "Malware payload (AgentTesla)", "value": "eeea96658f814be6ee3f6fa84299f577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085423, "uuid": "1d4ab9be-8790-498b-979c-792b9fd3ef04", "comment": "Malware payload (AgentTesla)", "value": "7866b3d9b7202921f2cf5dd641cc6435f9408cbb52fbec9d8110bd14084d603b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085423, "uuid": "d0f67a53-9fdf-4fc9-a7fa-4fbf89b83731", "comment": "Malware payload (AgentTesla)", "value": "63b72a38477597a642337a2239bf3781e166dd5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085423, "uuid": "68839c89-f88b-4194-a937-d000f2160b5d", "comment": "Malware payload (AgentTesla)", "value": "b0199c60e2c432e97ba40c351f29a6b9b26d14835df0ce8b672b9a682fd9cacb49a107b6c333fd38b0534c7d361bbef9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085423, "uuid": "172aa4d0-5921-4e77-b247-0654888afe9f", "value": "1105F13127655B91CABE87799136105053FAE457E302EB7EBDB920CD0C62FC98B72623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085423, "uuid": "49dbb548-9ca4-4fe3-bb09-e4e1647fbe62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085423, "uuid": "5c40dd29-61b9-459d-a7c3-474b4b836778", "value": "12288:nhAnvyx6yQOpkrgCVTbaakxaM9qBxaM9qELAj1sVowwJIN6jduhf/B:unQKHTsxF9SxF9TboBJq6jdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085423, "uuid": "1e2a9c38-9ec5-4254-ac41-ab1bf0970e2b", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085423, "uuid": "39f92258-580e-440d-a254-aff9b0941b4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085423, "uuid": "b81449a4-3aef-4c40-9135-3b9264aa2f57", "value": "OUTSTANDING PAYMENT,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973c2735-91a0-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140448, "uuid": "46e6152c-3308-4835-b00f-640a182d5844", "comment": "Malware payload", "value": "a5ea3bd09c916440fa6709fe722c55c8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140448, "uuid": "b9679861-f89a-469d-b6ee-a1199dcfef6c", "comment": "Malware payload", "value": "786a6493c9abd67c02fc851bd3e45c4c088b3e9976606355eb6a0369e67f41b5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140448, "uuid": "86d8888d-6962-46db-93bd-cfc9c0f64c78", "comment": "Malware payload", "value": "64502096dd279779e9661869323241f076ab847c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140448, "uuid": "52965d2e-08fb-44a2-9d1b-c43cf817bf93", "comment": "Malware payload", "value": "6bcc82aa9e9347561d3eeb3572865ff75549b5a5cc0e7410f5f6a24a6c1f2f7c0df70981fa01f4d9f9c4f396123de5ce", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140448, "uuid": "d9407236-70bf-49ac-ae46-9ad8278ae18f", "value": "5314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140448, "uuid": "a6addf6b-d6a1-4c86-a420-7c33b7ee5975", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140448, "uuid": "38704b17-f5bd-488e-8249-d9f19f83c496", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140448, "uuid": "ef95bd5a-d52e-4c4e-8655-eb0d718760ed", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140448, "uuid": "ba30acbd-f850-47c9-a5a6-6a12229ef493", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140448, "uuid": "2e94b110-18e3-4fe4-8d0e-a92cd344759a", "value": "786a6493c9abd67c02fc851bd3e45c4c088b3e9976606355eb6a0369e67f41b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced2bc01-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122932, "uuid": "c4302ac2-60df-4cc2-9838-991ebe2fbb08", "comment": "Malware payload (Dridex)", "value": "1f0871ebe274540154885bad363f185c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122932, "uuid": "6e5dd3d2-865b-41bb-80a0-7d5bd5f3b653", "comment": "Malware payload (Dridex)", "value": "78820c25766f33f5196c591e9791b2e4b818e8e16b795342fd3dca3c4d8f9fe3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122932, "uuid": "0816ab86-e029-4b3e-8f14-736155f61bbe", "comment": "Malware payload (Dridex)", "value": "bf1ecb5e85b49ff7d180e02e2e868200d06fd33e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122932, "uuid": "f57fa1eb-4396-42cc-a78f-cbe5dd20c370", "comment": "Malware payload (Dridex)", "value": "bccd678236838a0ab4f4afba5b578fe14cc8e17a3e3d149b71d2804d2be1e20c83728b369de811d27e8f74461b875182", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122932, "uuid": "2e9e0e60-6bae-4462-b907-343c7716ac6f", "value": "1314BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122932, "uuid": "1d97e58b-e617-4e0a-9cc7-1466da480d55", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122932, "uuid": "d1e8af69-5ed1-4244-b943-a112899f6823", "value": "3072:73PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:bJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122932, "uuid": "e4d18be6-5a3e-4792-afc6-6093977887b9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122932, "uuid": "9c32e780-1b96-4559-a192-89942e447ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122932, "uuid": "35d4f1cc-c961-4bb5-87ae-9faa7fc9f1ad", "value": "78820c25766f33f5196c591e9791b2e4b818e8e16b795342fd3dca3c4d8f9fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795ae836-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122788, "uuid": "b710be8a-8175-4fdc-a8c9-9f72fac8bfb1", "comment": "Malware payload (IcedID)", "value": "1b0d4a59dec7670b5c986a22353b5eff", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122788, "uuid": "e4969b98-3e47-492e-ba78-5f46afc978a7", "comment": "Malware payload (IcedID)", "value": "78f7644a6f320c9db0f272a9ac3e73d92ecff3b9699ca52cca83842676c27fe8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122788, "uuid": "25f2fa59-6b2b-4dd9-9900-d9e605932530", "comment": "Malware payload (IcedID)", "value": "0844d12062584b521c9d512429ab59549dc83a4e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122788, "uuid": "e04314a1-3a02-4f08-b6d9-6d6dc75d91fe", "comment": "Malware payload (IcedID)", "value": "acde2660f7517f4d23baa930c8364926997741dbf0e687aef5fbe056d7637bbb30f4061ca4c89867b508493c4e6e1813", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122788, "uuid": "8ecfa274-5d0f-42ac-8283-a6b7cc29d577", "value": "F1B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122788, "uuid": "fa985af0-1f91-4fc5-bbce-dc3895fb32a0", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122788, "uuid": "cffe1705-5e2a-452a-82a8-a7c414158da1", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122788, "uuid": "077dbd89-c131-434d-88c0-d22796316226", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122788, "uuid": "d99a773d-6e72-49d2-957d-cc55625df178", "value": "document-1470145924.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccb13ae-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108782, "uuid": "33977e7a-292b-45c6-b43f-806657e05467", "comment": "Malware payload", "value": "8bf8f90ad63f6b92c5524ac7b6ad7cdc", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108782, "uuid": "6dbc772a-0cf2-46df-a9c1-40a84300a274", "comment": "Malware payload", "value": "793fa51133f663bff3cd09acdb0784f4afbf0965963787e965436e91aec80d7a", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108782, "uuid": "c4a97b8e-56c4-4570-99b1-5bbe13de8a97", "comment": "Malware payload", "value": "6756d3c60b1db7bbe80dcdbba71bb8d3842c7814", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108782, "uuid": "82064d3f-3069-4567-8db7-c47e2d2299a2", "comment": "Malware payload", "value": "a4ba39c701bc7323ab1be0e6e1ffe2fb1443d49543ea346800d8b5e5decb29c0c5e9c03ff21e96de0ed39ae7f898346e", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108782, "uuid": "817ec19a-ef05-4b9e-8e9c-45b103b2355e", "value": "1D9312F290D9D211C3515756797CA91E4EE16E36B4E32C23249E2380BBD358E12F8F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108782, "uuid": "9a3c2442-69ff-4d92-949f-43b184584106", "value": "1536:U5K2Yfy6YjQ6bwhudyYr7ZN+KiSL7aGJKgUO/QdGpbjD983Goc57O+4:YYfy6J6bwhOyO7+jmCO/GGpHZ83Gl7/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108782, "uuid": "a3ed6c74-a2df-493b-8b3d-0ee509dcc8e3", "value": 95055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108782, "uuid": "d43fa9f1-0607-4855-bf5d-28082e91cdc9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108782, "uuid": "5f43a893-8b3b-4138-8c64-e9e03038e6a1", "value": "lista_1955.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a5949a-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617088347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088347, "uuid": "1860094d-a661-4da6-a879-a3a7ffbcf84c", "comment": "Malware payload", "value": "3c4da5c555e82a90cf9e1cb577e082c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088347, "uuid": "537afe24-a98f-4393-a468-f8d975120f96", "comment": "Malware payload", "value": "79638b28279f6fc16f4d3a24a73ac67a405aa548aa09d6ca09f485b8e7e13901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088347, "uuid": "f9049a02-0023-4b3b-aa8b-a0480f30ecc7", "comment": "Malware payload", "value": "776ec432c351b6a2c224d36d4b9e732cfa508795", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088347, "uuid": "c9b5b26e-59c9-402f-8a9f-0faf83dbdf6a", "comment": "Malware payload", "value": "b149a9353625b1b7a4def53ffdeeb575eabc1ac2aa28d75bdc4316158593f4f7ba35da3be73206d9c49619ab52c00eee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088347, "uuid": "1e0a54bd-f165-4e92-ae01-8bc1e6f4390d", "value": "DBB533213586D809C601AF31993EDE2C9A720F9554D9BF203BB5B6373EBFC599C1A08C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088347, "uuid": "b6c3dc79-90ea-433a-9079-a30aecd1a11f", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088347, "uuid": "4701c7d1-2afc-44a6-bf35-8594372bb7fc", "value": "49152:xh+Ja1ecQlcYlL+35uALXmQJOm/XcMafV8bl+ycVwduVQDHIGJYd7nJWmbo8h:xh5eXlcj3lUlqblbJuKDQnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088347, "uuid": "c7e22e06-3778-4aed-9b1c-807fc965a5eb", "value": 2399771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088347, "uuid": "f42855b6-3726-414e-a35a-a3b43d1d6c64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088347, "uuid": "ee6b4584-7ce3-434e-918e-85c8f0b09ed9", "value": "3c4da5c555e82a90cf9e1cb577e082c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275f2812-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136395, "uuid": "4cb1d3a1-f476-4ca9-868e-c6b018826964", "comment": "Malware payload", "value": "1b6d6db1063e7b0ad78ab0ca7ff5172a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136395, "uuid": "9c07238d-e440-4318-b63d-d657dee7e1c3", "comment": "Malware payload", "value": "79a6e7818681346a4506046e24ec15c50bb95ffb252ff2fb717c1792d2f0940d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136395, "uuid": "286eb85a-6844-44f4-9d82-1ff0e3d7a2a8", "comment": "Malware payload", "value": "f29cef1dd69bf740e42284fc7461722cf7922ef8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136395, "uuid": "d6176f5e-bd79-4a9f-8d35-818ab5c9c36c", "comment": "Malware payload", "value": "29bb7af9f3e7271d2468299fbced2b477f28888a4873a9c27e82ceaba73f00c6473306c59c72a46022e680b4e25c2170", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136395, "uuid": "a5214b4b-843f-4c76-9f29-8be8874477ea", "value": "7414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136395, "uuid": "85ac6c1c-db50-4086-baf0-477838ff10a3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136395, "uuid": "3426ff57-d5aa-47e7-86eb-2d6ff11a6e42", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136395, "uuid": "4d3e85e5-577a-472f-93ad-e1ad82361e7a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136395, "uuid": "1479274e-4eab-453c-807e-cb06df025f9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136395, "uuid": "e8edfe88-947c-477a-90fa-ab5c6d02d441", "value": "79a6e7818681346a4506046e24ec15c50bb95ffb252ff2fb717c1792d2f0940d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c859b8d8-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114331, "uuid": "94ef7490-c1b4-403b-9828-970cdd5332a3", "comment": "Malware payload (Dridex)", "value": "ad67af1ed8b05d5392ec1514d87f0d29", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114331, "uuid": "e3dc66ab-e21b-44b6-b188-259050a16596", "comment": "Malware payload (Dridex)", "value": "79c41b011e98a518785b11ff1433d9a2aa36e0d655ec99a45a3b54ebce672ae4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114331, "uuid": "6eb0ba41-a20a-4ea3-94c4-710cf786810c", "comment": "Malware payload (Dridex)", "value": "b5082da3001295f52cc107d63fdb92d0de29a873", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114331, "uuid": "a56c8acf-43d8-4fc2-bff6-08a3dea5d285", "comment": "Malware payload (Dridex)", "value": "45effc3e260f6ec21a06f19043bfd5d5aba230efc65ba0299d369e3acd2767b74f30cfabcacef6c7573b1a119d943b7d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114331, "uuid": "e77caaeb-220d-4d77-921c-c05e7e905052", "value": "C414BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114331, "uuid": "02e8ef41-09cd-44a7-9b5a-2b1a79839356", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114331, "uuid": "89111fe7-3d88-482e-9604-cbb8f0aefb7a", "value": "3072:h3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:5Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114331, "uuid": "1c0bbd8c-c966-4092-8e06-3514f16eaa63", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114331, "uuid": "5bcb0130-4cae-4ad4-9721-3bf04d99de9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114331, "uuid": "3d1009c4-e27c-4e2f-88df-df189efa64c6", "value": "79c41b011e98a518785b11ff1433d9a2aa36e0d655ec99a45a3b54ebce672ae4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8371174a-9198-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136979, "uuid": "b00f7774-5344-40e5-aa6e-d65cd1c70475", "comment": "Malware payload", "value": "9b4b5da52bdba06c78d6b7ea6a53ef84", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136979, "uuid": "2cbbd75a-f9d7-43e2-8098-4578f7453d53", "comment": "Malware payload", "value": "79c81e546c9a490886b0f1f82b87c6bfbc0840d6fc579e29a037847ea3c4668f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136979, "uuid": "211eb0f8-9c1d-477d-a7f0-3e5927ff3f11", "comment": "Malware payload", "value": "5bc910b7167c47fe638c49b2e85dc62d0baf6d1c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136979, "uuid": "410b132d-4bd3-4f54-859b-bed7669af6ff", "comment": "Malware payload", "value": "c059e340122a8c8c28a8cb5b40e4ed8a8024b5e967bc8f916db637a53205d7262aff2031e744ccf3ba33e0e51dbcfb01", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136979, "uuid": "b5573101-8765-4442-9df4-dc6bc0f6486f", "value": "0D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136979, "uuid": "ce9008e5-5c87-4243-94ae-bde5a1f44458", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136979, "uuid": "20c33116-e436-4ec3-8167-7a5bd753a3cc", "value": "3072:a3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:eJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136979, "uuid": "61356e1e-d2a8-484c-8c5c-8fb2afb5d39d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136979, "uuid": "7f0c1784-034f-4264-b74d-35b2f21f59a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136979, "uuid": "557b0ed6-f8e1-4e59-9ab3-7407359ccce9", "value": "79c81e546c9a490886b0f1f82b87c6bfbc0840d6fc579e29a037847ea3c4668f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3920007-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144039, "uuid": "59a5ab0c-390d-4dec-9b76-b9abeca2a434", "comment": "Malware payload", "value": "76b9d5c4aa633e12c5f253b45403ca0d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144039, "uuid": "013e292e-074a-4d35-8aee-e66cd57b8c8b", "comment": "Malware payload", "value": "7a2061911ca6313d3bf9fbd4f44e0d5ada056bacefb8539729fbf0a91175b668", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144039, "uuid": "45cdb853-3fba-43fe-8a4e-237486c94315", "comment": "Malware payload", "value": "1b99097baf08110ca0411dff3b8f8771bd38a8fe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144039, "uuid": "73bfb18b-bc45-49bf-a7f6-8d05990e9570", "comment": "Malware payload", "value": "1432cdde4dba0fd9add0ef8b2b738c65ac2426f44a330c9345daff90af3ba8f84f45f0a0e6720a0be46e90cd72d472ec", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144039, "uuid": "833d2ab7-ca3b-406e-96b9-c1a93a0c2a83", "value": "7014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144039, "uuid": "16992140-ceec-4bdd-91f7-70833d4784bb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144039, "uuid": "5ac17e51-db57-4176-9499-a83769ddc74f", "value": "3072:D3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:jJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144039, "uuid": "82c3039b-d43a-4381-a55b-ac287492b69c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144039, "uuid": "7220d5ad-5cbc-4eb8-82fa-da49458c80af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144039, "uuid": "4a45fe29-6c7a-46b1-b638-73c6dbcbc0f3", "value": "7a2061911ca6313d3bf9fbd4f44e0d5ada056bacefb8539729fbf0a91175b668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bbd77d-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Vjw0rm)", "timestamp": 1617114082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114082, "uuid": "d424ea38-2fe5-46d6-be45-27a31d02ee9e", "comment": "Malware payload (Vjw0rm)", "value": "46f0c5e1d453127dfa9f7c17f105de48", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114082, "uuid": "3bb9c8ab-4fd6-4e43-a340-db9b0ecb5ebd", "comment": "Malware payload (Vjw0rm)", "value": "7a3296ec657bfc6ecb44bce35d210211003ec02a9fdb1d52f194cceecf215a1a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114082, "uuid": "286d03b2-8a40-460b-886d-0b9e0073421a", "comment": "Malware payload (Vjw0rm)", "value": "38597081df8ebd2d0f277637ca14d3ac9e610bbe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114082, "uuid": "c5b6652d-91cc-4902-b4b0-6505221c311b", "comment": "Malware payload (Vjw0rm)", "value": "ca4e3b4af4f043f6ac23ea58a01059d310312b117d2ef5d1620eab08c0d5b3ea3c53e37e84eb38e6bf560eb43cead5ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114082, "uuid": "056fc77a-fc59-40a3-b175-a9fe507e9ae2", "value": "C581209C284B863C47D27B8B802ED14CCDF548B47E28D2B6148CDAC5360E979C7B29BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114082, "uuid": "74c42732-1d57-4004-b39d-29a76ed1732f", "value": "96:SABNo5Drk2c24ZRMHXE6/BIR6+Ys+fJPdDdQqR7bJyKhEOS4UK:zSU2c24ZRMlBInYs+fJRfRf1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114082, "uuid": "09d715ff-47ef-4d6b-a4f2-15ac087b3034", "value": 3878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114082, "uuid": "2bff09c1-4bd7-494a-808b-63e009e0b48d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114082, "uuid": "515eb550-c524-4ac7-b7ee-30e3dca6f682", "value": "OrdUZ5201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374a19f0-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126972, "uuid": "bb3a205e-c8fc-46d7-8bcf-7e8e268b81e4", "comment": "Malware payload", "value": "62f4d7481b77f80d84d574715f2e6d66", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126972, "uuid": "3b547b5f-d48a-4f5e-988f-15d668b5aff4", "comment": "Malware payload", "value": "7a5660b4470538b90dd94df9744ba18fea7096a87468be3284beeaaa73c3d5a5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126972, "uuid": "741d1271-16ed-4103-ae42-c96fc326a8c5", "comment": "Malware payload", "value": "bcb0d67dbceae257ed765715640df039553023f8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126972, "uuid": "3f930e22-e6ee-4861-be5e-cf73c1fe5aca", "comment": "Malware payload", "value": "8f0072cc48e1e638f2960c60591444a7ea43f6ec2478059923bc147f479e1b53a0105262abcab1a408c053eb1895380a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126972, "uuid": "cf2ea270-7721-4656-9eb1-cb446fc77c11", "value": "3514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126972, "uuid": "2bbfe6bd-fa96-48ec-9671-357aa743cc28", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126972, "uuid": "f316ae71-34f0-4710-b5fc-7b1a3fec0fe7", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126972, "uuid": "57e50f4d-bafd-40b7-8de2-c8fe3a034f57", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126972, "uuid": "0664f3d1-fd4f-4d97-8e43-5f8057e77aec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126972, "uuid": "3dbdde7b-2071-478a-8c8b-557c9a526e82", "value": "7a5660b4470538b90dd94df9744ba18fea7096a87468be3284beeaaa73c3d5a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9c3f63-9132-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617093049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617093049, "uuid": "a95172da-814b-4851-bdea-f046dd30bd22", "comment": "Malware payload (NanoCore)", "value": "509d57f078f983b19f87faa7be667b82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617093049, "uuid": "4170cdb5-a627-486b-8a9f-f233880bb809", "comment": "Malware payload (NanoCore)", "value": "7a6e483857e7738d345256d4c17e2f3a14eb70bff468b84244271a902b545a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617093049, "uuid": "17a3739e-db8f-4750-9815-833d7c6f54ef", "comment": "Malware payload (NanoCore)", "value": "b378518d12829ea24fd322cb7f0209fb61852038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617093049, "uuid": "4a5c1abf-1128-499f-ba62-25233d7b4b06", "comment": "Malware payload (NanoCore)", "value": "9aefec8e889e54210c78864bd1a755e3dcc1808122cfd3f7cbc531c58e2931b340cc228089a29bd73a3755366fa15598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617093049, "uuid": "63f16447-fc39-4054-bead-3836875a6d3e", "value": "08E4B2A870AE405DEEB46B34F5B595821FC825321F62FF3F28E657005CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617093049, "uuid": "edbee1d5-5afc-48bd-a977-e3cd44fee8c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617093049, "uuid": "71283b96-3336-47e8-8f17-5fa1e76493af", "value": "12288:dk9bwPNwQ/nQEgIn/7DUrCkj+bitNgsb:dgbINwQ/nQEx7D+CGuitNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617093049, "uuid": "a910730a-b510-4e76-9756-f7b614bb5e7a", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617093049, "uuid": "28021586-9715-46ac-8d68-2627d2560c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617093049, "uuid": "1105c5f1-480f-40be-a60d-2d1a7fec90a1", "value": "509d57f078f983b19f87faa7be667b82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360eca87-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114085, "uuid": "3a6cace0-285c-4e3a-b2b7-b34691bc2284", "comment": "Malware payload (Dridex)", "value": "70d3927cd27f44987aa764d76db03493", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114085, "uuid": "f7a2ba2a-7561-4b82-a783-446fbfa57a2e", "comment": "Malware payload (Dridex)", "value": "7aa8057755831711eba96d0279f3ced6f4f58810e4547f964710709b2427e8fe", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114085, "uuid": "ac2389a6-df7e-458f-8ac8-db0fe4f749c1", "comment": "Malware payload (Dridex)", "value": "3bed720e3372a324fe4ea5597eff2787e11e2199", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114085, "uuid": "b52452cc-c574-424c-a21f-8cfb4edf6316", "comment": "Malware payload (Dridex)", "value": "b0b8709cf4ec0415e19d798455a5311c690eb423ddbe2406e362c7435a6acff203931d7e3f93420821c889fe6ba9c6c3", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114085, "uuid": "b87c031c-5e96-454d-bdd6-ba80d74afe31", "value": "2314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114085, "uuid": "711d2d2f-eb05-4e5c-a7fd-eeb81b0094f6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114085, "uuid": "0b662493-e68b-421b-8a7a-ef1a359d08bc", "value": "3072:U3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:QJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114085, "uuid": "455b1b3f-e4c4-4ccb-b829-aea4d87503eb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114085, "uuid": "834c949e-1152-426d-ab25-e55e013e1803", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114085, "uuid": "c8fe8790-db11-4d5f-9e1a-c4463051fa88", "value": "7aa8057755831711eba96d0279f3ced6f4f58810e4547f964710709b2427e8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df903aa3-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1617088171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088171, "uuid": "b5ad693b-ef69-42f7-8cd8-fcf8bbe4b7bf", "comment": "Malware payload (ArkeiStealer)", "value": "0fa17ae7e96f0340621e6082a501888f", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088171, "uuid": "46b77e00-54e8-4657-99b6-954f9fe48f73", "comment": "Malware payload (ArkeiStealer)", "value": "7af76f869eab565b2b7d3ec5f141e5d8cd94551a6b1b31e0d8af7c3ea2b5a7db", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088171, "uuid": "07625802-2275-41f4-a22a-a522a8bdf809", "comment": "Malware payload (ArkeiStealer)", "value": "a45347162310320e4ba2fcb5b3d7087794141b59", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088171, "uuid": "c8a6a1ca-cd79-429a-9cf6-04d85e5402b5", "comment": "Malware payload (ArkeiStealer)", "value": "b353eed0620958598bb06e79e4b18390b2c46853455058452cbd2716d84d13253d9f20885d998b374c5ef61f8dfda453", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088171, "uuid": "cc20a2da-f8b6-4938-aefb-5864dff3b6e8", "value": "A4C5332132C6D804C601AF709D3DAE2D9A260FA554D9BF203BB5B6372F7FC55AC1A09D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088171, "uuid": "6918f55e-9bc5-4dd6-bc7a-8cb79e5ea198", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088171, "uuid": "d8bfa639-59f0-4dab-bdee-102774537302", "value": "49152:zYK1h+Ja1ecQlcYlL+35uALXmQJOm/XcMafV8bl+ycVwduVQDHIGJYd7nJWmbo8h:zYeh5eXlcj3lUlqblbJuKDQnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088171, "uuid": "e2b0af30-63f4-4759-9f72-dc03f697804a", "value": 2601461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088171, "uuid": "f4cf5bac-3a7e-492f-a00f-7b47a0dc8ed7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088171, "uuid": "8e2ac01b-82de-4684-862c-ea465e2b5ada", "value": "0fa17ae7e96f0340621e6082a501888f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501af998-9179-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617123578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123578, "uuid": "714f27a1-5f20-4ff8-bfbc-e6b5822576d1", "comment": "Malware payload (Dridex)", "value": "4df27608451ce8b7038e9342a9d1a363", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123578, "uuid": "e2a55404-0f72-4d2b-b7de-cbe582566fb9", "comment": "Malware payload (Dridex)", "value": "7b324ff611491985578ba25aa1ba3e60c2f33ce568597f41f3155411e6695c4c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123578, "uuid": "f1bef6e8-dfcc-4f8b-81c3-7e95290245fa", "comment": "Malware payload (Dridex)", "value": "c62ef01f04bb27e2721547054b6d1db1b117f3c4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123578, "uuid": "653380e5-7cc1-4d62-9004-2a490f84935e", "comment": "Malware payload (Dridex)", "value": "3fe64dba9da7f47ea6c3fd93a36976479ee27db453e56cfe23dc9cc5631bed5395c03635335d398d80b941a986ff31ce", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123578, "uuid": "f429633c-6f93-4dc3-8577-511cef8b43ef", "value": "5A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123578, "uuid": "c2f77ae6-66d7-433c-9034-72f37f69e251", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123578, "uuid": "ca528848-7826-4703-ba62-cb6c80acfb93", "value": "3072:n3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:/Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123578, "uuid": "e6826d67-fd23-4369-9191-cbe633d13b38", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123578, "uuid": "89870fe7-d033-470f-9682-f22f24d3334c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123578, "uuid": "62be4b80-76db-466e-9ce8-14039981311d", "value": "7b324ff611491985578ba25aa1ba3e60c2f33ce568597f41f3155411e6695c4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1dc9a9-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121884, "uuid": "81638aad-1def-4888-82d3-072ac74f5050", "comment": "Malware payload (Dridex)", "value": "78edcc28cbf92c6c24fe4908f27959c8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121884, "uuid": "c8606782-5960-4fa2-a3de-2a392dc8b521", "comment": "Malware payload (Dridex)", "value": "7b523574ed62f64a56a3f34369188bf6a659751b43018ade1658dc163cb58aab", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121884, "uuid": "e0885b5b-3f6b-4aef-b039-2c9b44b0c88b", "comment": "Malware payload (Dridex)", "value": "7e42372b8e1a87ca5830ae34f3f03177a71f559e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121884, "uuid": "7e7862b3-8860-43ab-8750-3f89df8d9610", "comment": "Malware payload (Dridex)", "value": "4273ede61b3cb0ebc6bf4bf0da025336b39cf0e30f2252ca263bc5402f9fc9c08320638f5d3b6111863068a69900c3f6", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121884, "uuid": "3a3d376e-793f-4acf-be29-8991e360d976", "value": "8814BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121884, "uuid": "62f05d25-5d64-4e6f-80bf-6942cd5f8ecc", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121884, "uuid": "20c1b529-b73d-4be5-b33b-672767613f26", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121884, "uuid": "326ddad9-fade-4c41-b60d-0d429ad00eb4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121884, "uuid": "93c2b4fd-f433-486d-8178-993bc1790a42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121884, "uuid": "b5bc2fcb-4b14-4edf-a56e-e9a5ac2a0bb3", "value": "7b523574ed62f64a56a3f34369188bf6a659751b43018ade1658dc163cb58aab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f3137c-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120608, "uuid": "34c06140-409d-4f15-ac84-7f3ae721ba05", "comment": "Malware payload (Dridex)", "value": "c97da59441dfe9b552f7cc303eebd8d7", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120608, "uuid": "278675ce-6f9e-4727-adf8-207a49738276", "comment": "Malware payload (Dridex)", "value": "7b87d107a062ce90105d97c9f83ac9ed05594318c4e4abdc9987a6fb901e46ba", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120608, "uuid": "a56cc2fc-7798-41f6-948a-e23f6d357377", "comment": "Malware payload (Dridex)", "value": "f93a4d12ea76cf5e31af43ebe35c05434c8d5908", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120608, "uuid": "c9ba3f81-ab28-4a83-9e24-5766b79cb74f", "comment": "Malware payload (Dridex)", "value": "976109e626477e6fd50a7c8f1749af8e1e53337b2240a4241784215f6a4f1c79de53278eb8d0388eb951fce5258caf0a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120608, "uuid": "39491b69-f1e7-41cb-94b3-f9c5de132a10", "value": "D314BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120608, "uuid": "a07af5b3-dc20-4ee2-b2ed-d948c4a1eb88", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120608, "uuid": "272c435d-ec41-43f3-8b40-6e87c81d8073", "value": "3072:d3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:dJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120608, "uuid": "837630ab-b7b2-4af5-ac13-7d4992865854", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120608, "uuid": "dcd17354-4f81-4491-bee4-3387ffe17655", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120608, "uuid": "5399e3e4-865d-4ce4-b45c-9ef650ecd807", "value": "7b87d107a062ce90105d97c9f83ac9ed05594318c4e4abdc9987a6fb901e46ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ea11c8-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121781, "uuid": "f40fa4a0-0a42-4bec-bfc1-bfc8907c64ae", "comment": "Malware payload (Dridex)", "value": "33c8c722bb19429b02b279a8d3ebeffa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121781, "uuid": "9c70a2bd-ce40-4305-b9cd-f28438a1857a", "comment": "Malware payload (Dridex)", "value": "7b9a0fc5ee76a2bae412464f2bf96a46d58d71edc1e7652a4cebc47281a1e2b8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121781, "uuid": "e12604d5-0640-4754-a66f-e227b34aedc9", "comment": "Malware payload (Dridex)", "value": "dc3bc1cee55accbc12c215d4069ab473908a2d85", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121781, "uuid": "8ae9a06f-4731-482b-b0de-0141711766d1", "comment": "Malware payload (Dridex)", "value": "e1ecb2b6ffd81ba0b34c413c89699816f2817cee4cd882f59476e34c45d20bd44c3c0614ba779be1ecffd835413293e8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121781, "uuid": "0bda4c5c-5007-415f-8ea5-acb09788f3f6", "value": "1114BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121781, "uuid": "977f3de6-0e75-4cef-b79b-d469463bb769", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121781, "uuid": "4b1cd480-a96c-4c61-9523-8d736f31501d", "value": "3072:23PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:yJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121781, "uuid": "607b3f9b-23fc-4df9-a6ef-ac986744f64d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121781, "uuid": "4501a69a-36d2-413a-bbc1-83ec7fa0f53d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121781, "uuid": "e153894d-2344-4eef-a605-c2064e5ce803", "value": "7b9a0fc5ee76a2bae412464f2bf96a46d58d71edc1e7652a4cebc47281a1e2b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "060f38bb-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115293, "uuid": "dc415a74-90ca-4fe7-9257-af5070b8dc5c", "comment": "Malware payload (Dridex)", "value": "7ae94f2df0d59494dde2c93fe136dbf6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115293, "uuid": "88d9655d-6532-41e1-afd1-19d7a4fa751b", "comment": "Malware payload (Dridex)", "value": "7bb3d1e19aa08000a86d87c79750e1819ef9de7e919f33126124c572a57f26a4", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115293, "uuid": "3f77f2ac-7929-46e1-8d73-1aef5963254e", "comment": "Malware payload (Dridex)", "value": "6ea91844637d189f2ee9175841a7f31eb400d602", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115293, "uuid": "e4822ce0-1b93-4a03-a362-cb301b83da49", "comment": "Malware payload (Dridex)", "value": "0610be15fd3761bea57c53b1d24d6e6225d3413edfcc17e030ba11e53f88db777e72158477b1a4274a2f7cd81254800d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115293, "uuid": "a33181df-417c-4006-9c60-7f1b0d23b3dd", "value": "3714BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115293, "uuid": "0a372e27-370b-4699-a4ed-d18cf3bd3720", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115293, "uuid": "b6e1a255-ee25-4d3b-9506-a9ff325051f9", "value": "3072:X3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:PJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115293, "uuid": "6084c1b9-27e8-4cda-b989-def18b8ae34d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115293, "uuid": "929d4340-7352-4b21-8844-f16c20d2ebfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115293, "uuid": "4e400ead-3854-4cb7-96c6-942e2df11237", "value": "7bb3d1e19aa08000a86d87c79750e1819ef9de7e919f33126124c572a57f26a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30681462-917d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617125243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125243, "uuid": "67581c70-81ba-4324-bd92-16275bf962e3", "comment": "Malware payload (IcedID)", "value": "d679021c613f2df890c5f19198bcb9ce", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125243, "uuid": "ac818902-b55e-4203-91e5-d9a4761f1026", "comment": "Malware payload (IcedID)", "value": "7bb4afe7e9214feb99499643d3238afe78d87c84be12757a9581b797b0adb593", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125243, "uuid": "238fd84f-cd33-4e3a-8f4a-c4928350901d", "comment": "Malware payload (IcedID)", "value": "cd6c50418f91895bb958e3041ab63c204a644830", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617125243, "uuid": "609182a5-f376-4568-b30e-fec62e5d2da0", "comment": "Malware payload (IcedID)", "value": "acf256d44c5da3716fbe0301945f578780f14409a7be22dadaf4f42bbe12a1182fa428259ec31e4d367855e17cd9b595", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125243, "uuid": "c72aecfd-f102-4dff-b9e1-e1fcb30244bf", "value": "A5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125243, "uuid": "777e7cc8-a8e6-4e6a-ac1a-50226ada34ab", "value": "3072:y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:yzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617125243, "uuid": "d487a31e-0d6e-4d5e-8b8a-3929b70525f2", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617125243, "uuid": "08c6f0c0-04f1-41f8-815d-aeb275c14a0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617125243, "uuid": "c06c37b1-beb1-482f-b3c4-ce0363d11574", "value": "document-978503993.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f731bb59-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121281, "uuid": "de8b37de-0f9a-42a0-89bf-3ed828f139a1", "comment": "Malware payload (IcedID)", "value": "2f6663b8fad133aa90dc434e48145eb8", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121281, "uuid": "c7a632e7-d01c-404f-a4a6-900f01547d8a", "comment": "Malware payload (IcedID)", "value": "7bd1a168893a0a0d67e7f935c10a33545febf3e72c97e20fa74556f31e2ea4cc", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121281, "uuid": "27a406db-5d95-4419-ac91-bae39d457d36", "comment": "Malware payload (IcedID)", "value": "71ca1afe3d30fddcfde498eb19d7c7db7467be8c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121281, "uuid": "6aa44484-0deb-47c3-80ea-487b3c595159", "comment": "Malware payload (IcedID)", "value": "61a384ad2bf036913f73a15e35c30219fd4f2f152c3a976d74bd7305c97869a0b08530f274f9c7951eb3e97f625d1361", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121281, "uuid": "d23f7bc1-6e1d-4f98-b3ad-f5b82f7536d7", "value": "32B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121281, "uuid": "91a4d05c-88d1-429e-bda7-220ff968cd4d", "value": "3072:M2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:MzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121281, "uuid": "586d5034-72a4-48b5-874f-25c1f5867148", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121281, "uuid": "06c4b2f8-5ab4-4680-b41e-ae404d8e9850", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121281, "uuid": "b40ff01e-f8e5-478d-92b3-96d6f6c8af9e", "value": "document-821379038.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dab498-91ae-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617146370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146370, "uuid": "8a9db310-5c58-4548-9248-40b2ef0486be", "comment": "Malware payload", "value": "2cc65afdf8921497f8f5fcdc6ee26e68", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146370, "uuid": "80d1b1ac-5816-43e2-87af-ddc409ba43fe", "comment": "Malware payload", "value": "7c96167a2f1a0b3585f9bb46b6abb90c82e399a5ce8a38d0cf44e0d98f57917e", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146370, "uuid": "810fef65-bd1f-4749-9f0d-688ad3a23d09", "comment": "Malware payload", "value": "5f97eaf9b62d9a7a6b1e57c9fe247307c8e2f069", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617146370, "uuid": "c7f967a0-91e5-4e3e-8540-c89c8c7b69eb", "comment": "Malware payload", "value": "18c4835526b45eb6f629eb3c4b2fede15882e52aa2ec97e508ac331c46905d56d7a3fb0746c16004ab457409d966b9f7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146370, "uuid": "9a34c383-76d5-478f-97a4-93252200bd49", "value": "6C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146370, "uuid": "353d0e5a-86fb-4959-9ac3-fd454e229bd5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146370, "uuid": "46224d09-b190-46a1-9be2-ee3e2552c2f0", "value": "3072:u3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:KJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617146370, "uuid": "02239ba0-0374-42a9-889e-e460ca10f42c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617146370, "uuid": "e7ac030e-45b1-44e8-a6fb-88eab77711a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617146370, "uuid": "1bc95e6f-d9e5-4016-9897-8f2c0936ea25", "value": "7c96167a2f1a0b3585f9bb46b6abb90c82e399a5ce8a38d0cf44e0d98f57917e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439d7b7c-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617105518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105518, "uuid": "bd7b8441-b033-4d83-8671-695e481d68c2", "comment": "Malware payload (AgentTesla)", "value": "48e6aa44408361988ad4beb8448f9d36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105518, "uuid": "3b8b8dfa-4e84-4c36-bafc-5262cf37c5ea", "comment": "Malware payload (AgentTesla)", "value": "7cc66bfd3c08fe5a68809fe7f3a35e8948d8990460fdfd88ef4aa3abd84188d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105518, "uuid": "62fa2500-7fab-4983-b5c5-3925027409d5", "comment": "Malware payload (AgentTesla)", "value": "67eb44c961bde53bc017d6dad35f9fea8006d2be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105518, "uuid": "4a7ef1bc-039d-43e3-9d78-96f6c7a1f517", "comment": "Malware payload (AgentTesla)", "value": "b6b9216ee4cdaa0f6896f591c3c4e8c2b2774ec474de03e1c6a296160bf0c16461a6b3d66c41c324e75d565b42440afe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Endurance", "colour": "#8FE208", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105518, "uuid": "2c6e7ad1-232f-4f53-b761-de1104847fd2", "value": "5164AEB876047DE6667F536BDE96ACDD03B627229ACBA4CC8065B7C30463735EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105518, "uuid": "536a3ffd-7360-4e51-88c9-cd70e452ee07", "value": "6144:/v0ShQ2D21sG3hm5n4UVlwmxXR0dfJrJOmaBQqSBpMLfYBbOJQwDYD4/97GHMJwP:0qD2pAF4KtxXRYftJOnpSBpnsJQwq4/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105518, "uuid": "3d99e885-c38a-49a8-b5b8-46eaea1c7545", "value": 314860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105518, "uuid": "bbd98c9b-5dad-4f7d-88db-6028280503f2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105518, "uuid": "7c91640d-9c17-474f-b7ed-c4a2dd3d2cbd", "value": "Purchase Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0b37f7-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617082905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082905, "uuid": "8d2a8322-fd37-48da-b39f-85e964d5e05a", "comment": "Malware payload (AgentTesla)", "value": "b7a6b143c41b6ef357405601eccb730d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082905, "uuid": "f57b952c-94d2-4278-927d-f8fe8f6480ec", "comment": "Malware payload (AgentTesla)", "value": "7cf241b7627c8ad2713e5db277835dfe1c872ff33865942dd553e7d088637ce5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082905, "uuid": "3c1e121d-ebde-43b8-a464-8b6fb633de9a", "comment": "Malware payload (AgentTesla)", "value": "4a1421bfbb083e9c41e510d9a0d06efd446ffd19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082905, "uuid": "6966d911-22c4-4459-bce0-87d0720dbe2f", "comment": "Malware payload (AgentTesla)", "value": "4a68ba8078287d42fe7126ac2a066fb7081409530baebefb6226870bc3780f3349cbcf814ace7767e3a1ebf896ce215b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082905, "uuid": "35fe7e62-b46b-4923-8ebe-3c2857098fc5", "value": "EA059398A09E405CDEB46734F575C9A20BC62D361E72FE3E28DA3A123DB77A5F50E410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082905, "uuid": "731faf10-dd42-4622-99bc-99b3793316bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082905, "uuid": "e81bc696-6d34-4ff9-b429-1dd1371937cc", "value": "12288:+jO2fmBPy/kvEXMC6BFXa++9Z3gB+y0J5kcABAmlpuylP7r9r/+ppppppppppppZ:D7Py/kvE8CS4rAB+yG5kcABAmas1q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082905, "uuid": "e346ec4b-77b4-4e3f-920c-d31474342f21", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082905, "uuid": "679eb621-a568-4924-b36b-9d570ddb5c1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082905, "uuid": "460322b4-4f43-4b78-bb99-818aad8d434e", "value": "Proforma Invoice No.42037 For USD.78116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c06a1d6-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126578, "uuid": "5b9dc760-67b8-4b82-ab16-ba6f8a097569", "comment": "Malware payload", "value": "96f287eccea6a0b49d6cf40d607c5433", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126578, "uuid": "69a8aeb6-ada4-4d6e-94b6-18a37651a187", "comment": "Malware payload", "value": "7d34317d73e45736489fd832bb59154cb657bf37cabaafb039784ccf5a197338", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126578, "uuid": "feb8b04e-f241-481f-81c7-8c781c18e6a7", "comment": "Malware payload", "value": "cc5c75f2ce490aaef105467c37334f2c0a13a429", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126578, "uuid": "d3a248b9-627a-49d3-8d52-d1835070fec6", "comment": "Malware payload", "value": "e31b4a4499748559595684c40630128e0373e0b8340451c97c916ca8d24122cd3bfc93fc5e632c880466028d8445289e", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126578, "uuid": "83709f3f-2a53-4a5e-923b-991b8a5a4128", "value": "F7B3BF5EB254B45EC38FB53C9606A8E748861042E852B53F35B07E0C65AE2D31F9F5EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126578, "uuid": "8e78aba5-b91c-4581-9811-4dc74ad23b05", "value": "3072:5yPT/s+RGIzkSAmc0175TdV/vEQSlcC54:Q/sqvjX7Rd7ucC54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126578, "uuid": "41fac9b7-881d-4bd1-9c93-4eaca50bec22", "value": 109102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126578, "uuid": "1cab3ed7-6d62-4244-9dbd-dd7fcb64e4f0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126578, "uuid": "05a18606-3cd9-4486-8fe6-1fa0d2cd45ab", "value": "licenza_990.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f705e97-9112-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617079419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079419, "uuid": "b38d4ad3-60dc-435c-a78b-5f687ee995c6", "comment": "Malware payload (Quakbot)", "value": "d98ebc295bbe5c59834f910acf25a29c", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079419, "uuid": "a9f5ed1b-5337-47a1-ab6c-35fa8fa321e3", "comment": "Malware payload (Quakbot)", "value": "7da77c673f1b13fdd3449b4df25537e99cb7ae49f906550683b95517d5681b11", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079419, "uuid": "b148fd01-1269-4bc5-b188-b48135e898f5", "comment": "Malware payload (Quakbot)", "value": "948ef8f3fbe70bc3c9a1db8e2e58e5fdf2964278", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079419, "uuid": "5bff2ef1-d46c-496c-bec2-11b1c7982d65", "comment": "Malware payload (Quakbot)", "value": "09ed6aaf20ee47ad783e7eb514e6e867f83c112b195b5ef46de68ec7d8afa492ea01691d53828f4cc7bbb5cc07298908", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079419, "uuid": "6fed415f-28d8-4bd0-a060-87fff4d3124a", "value": "50C3CF8EA248750EC39FB43D8A0368D70D921056E952B53F35F4BF0DA6A92831F6E5DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079419, "uuid": "304debf6-4cd2-4d39-9f8c-628efd12750b", "value": "1536:Hx60WSanR0iB/X+qIyHOOoCSxTv7xVMsigZEQNggMorCKR5w7rsohFJ/y9Xj:RrIVXrI/CKTdV/vEQSlcCq5w7rBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617079419, "uuid": "96543fed-d52a-4902-96c4-21d765b08f66", "value": 118936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617079419, "uuid": "85e9c60c-597e-4849-a012-7b0e939e4aaf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079419, "uuid": "6753747f-0071-4dd9-9e6e-be1695772da5", "value": "lista_2801.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ba9482-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114971, "uuid": "59d6fb55-4f95-495e-8e7c-431c5fb0e20b", "comment": "Malware payload (Dridex)", "value": "c85e30aa999f10b7cc9a98023fba937d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114971, "uuid": "516630e5-37b8-41f6-99b4-b7035bd931d1", "comment": "Malware payload (Dridex)", "value": "7debd9178a33402d7651bf2e45cc24da2b5fdb56ebdf6cb999d1e49ddc545c57", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114971, "uuid": "add0c8d6-e56b-4732-97ea-6ca5febdb052", "comment": "Malware payload (Dridex)", "value": "6851cf477fda03707b6c26b4663b42a6a8e4d735", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114971, "uuid": "8b05fac3-2d94-43ee-983b-0854e2280f97", "comment": "Malware payload (Dridex)", "value": "bea3d2d3d16cf1c7d797b8aeea3d6cf56dc024c26085d356f8801ca62823cd0ee2965223da4964b0c0ab0c9157c3f11d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114971, "uuid": "f47343ad-5a31-487b-a941-1bbc91b20081", "value": "CA14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114971, "uuid": "83b8188a-d49d-47e2-9a3a-62b74170ff22", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114971, "uuid": "23d9eb2a-3852-472a-b5ee-0887924def70", "value": "3072:83PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:4Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114971, "uuid": "5571295f-df74-4656-a527-2693b6d66be7", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114971, "uuid": "5249d105-154d-481b-a6ff-66be3ee0e4c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114971, "uuid": "7985262f-a6fa-4dce-986a-5f69d309348f", "value": "7debd9178a33402d7651bf2e45cc24da2b5fdb56ebdf6cb999d1e49ddc545c57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bb1952-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120338, "uuid": "83b951d2-c2ec-49c7-8956-e62eb87bdeb4", "comment": "Malware payload (Dridex)", "value": "5f7ed614351ab89280d33c131be4583a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120338, "uuid": "3100e668-3c48-4525-9c22-f2590c6359b8", "comment": "Malware payload (Dridex)", "value": "7e06f8512f37e83a47455389d09698db871ea8485e43b6c7ba6c975e62f60c7c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120338, "uuid": "0d3c32b3-5b3a-4acb-81c8-21bda7b4b129", "comment": "Malware payload (Dridex)", "value": "90d257b42e53143368ddaee12c997e7a3397c3b4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120338, "uuid": "aebe1bf1-9262-4cf0-a27a-4df19ea9c986", "comment": "Malware payload (Dridex)", "value": "b370a59a4bbb64ab3ebeada593c7a63dea7f51bff6bad839d3b6de45cdd13e4da378b2b3be1086ba912d7424d507d9b5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120338, "uuid": "62628760-ab7c-4443-b70f-7dc20ff72c5f", "value": "5114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120338, "uuid": "c4e92aa9-4246-4042-a5a2-4bd0a4d6ba27", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120338, "uuid": "835e2dac-0ab1-45b7-a495-7e211ff407e6", "value": "3072:g3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:kJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120338, "uuid": "86b7605f-9984-41e3-8dff-bdfb8a33b712", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120338, "uuid": "6438d8e8-7d20-47b5-b2b5-157ee62922b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120338, "uuid": "685941ba-650c-4d37-8876-54b6306773b4", "value": "7e06f8512f37e83a47455389d09698db871ea8485e43b6c7ba6c975e62f60c7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa70cd32-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120294, "uuid": "9a7e83e4-0715-42b6-aff2-69750185a580", "comment": "Malware payload (Dridex)", "value": "43f2c00762fe2200ef7d6cde6d5d1bf2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120294, "uuid": "23ad5204-f343-4270-97f7-b21ff90ed6ba", "comment": "Malware payload (Dridex)", "value": "7e8e5d483bbbede225f55d91d04c794d0f93c756ae28ea7ae0363f3bf10823db", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120294, "uuid": "2af43377-5783-4185-a36c-1517c2fd74fe", "comment": "Malware payload (Dridex)", "value": "04a96f902434d00a7cf87f94f6f8c06089394331", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120294, "uuid": "93e70685-be52-4d28-8186-ed66740c0762", "comment": "Malware payload (Dridex)", "value": "9c85cd6f5468295d047316bbd2623ce426df08d5907b87fd6241b8870db9e709ee208a04536d39d193e3952839e5cdbc", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120294, "uuid": "a53f105b-dcb7-43f5-a28a-bd1e21f62a84", "value": "4014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120294, "uuid": "498ac1a4-c7e3-4206-8ac0-8c393969ebd6", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120294, "uuid": "902744b7-db00-4e78-8c8d-3e273676dbfc", "value": "3072:C3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:mJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120294, "uuid": "0b49336f-09be-4e0b-8731-6c568803bbdb", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120294, "uuid": "b8636374-11dc-41f3-ac63-f37bc28bbab4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120294, "uuid": "b732d91e-c694-48b4-b2b3-af73a0adf93c", "value": "7e8e5d483bbbede225f55d91d04c794d0f93c756ae28ea7ae0363f3bf10823db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f1d180-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617088532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088532, "uuid": "3b0ac95f-7507-4fff-af86-30bbcd5825c7", "comment": "Malware payload (Dridex)", "value": "23f329cc590c3ccff448f6414d1bd944", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088532, "uuid": "8c575f01-24c7-43c1-83cf-50c62c41bbcf", "comment": "Malware payload (Dridex)", "value": "7ee3baa31eb1196acdb219c0398ca6b096e6ef215946f20f729e40c67d487908", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088532, "uuid": "a70364bf-8970-40bc-922c-0efbb6822815", "comment": "Malware payload (Dridex)", "value": "5690a3432dcad9fbd60cf8953c409cf575c3ef85", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088532, "uuid": "85f35f86-737f-4ba9-ba00-ad1df2794e80", "comment": "Malware payload (Dridex)", "value": "5dd352b13207462b91fd648faf4c450e92955f4775f1ca11f7b2618a6371756af4a578a5f626bf8856c8678b05c7e202", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088532, "uuid": "2a616bb8-2e09-4e40-8c92-92289794ac8d", "value": "D6C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088532, "uuid": "1f711569-2895-40ab-8d45-2335b49034c7", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088532, "uuid": "81cbd663-8661-4d04-9296-3300f81e2c7a", "value": "6144:mGiMOQpsduhD3AZHC/uNbExd+4fuwf1b0717WLmw6Xg6DqaIDnnlvghs5la:nVhDQZHC/uNY1/fRm8LYQOQlYul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088532, "uuid": "88076758-cccb-451e-8857-4aba1c140732", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088532, "uuid": "a3acaf38-e0ae-4a63-ad50-b5d4fb88ba4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088532, "uuid": "e104aac2-4e6e-42e3-b20e-66ca7cc06719", "value": "7ee3baa31eb1196acdb219c0398ca6b096e6ef215946f20f729e40c67d487908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7b679b-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143648, "uuid": "a553e4fc-0c81-46e2-80e0-8ab35e4cc42c", "comment": "Malware payload", "value": "9143a373da62638070883e5069574176", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143648, "uuid": "7685ea21-7917-4010-838d-30cae399b918", "comment": "Malware payload", "value": "7f721141b9a5d5ee1bedc9729e3b5003cb2d161305b046090495b036e590394e", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143648, "uuid": "968ced71-1d49-4416-a31d-a48ca9dfb7a4", "comment": "Malware payload", "value": "f64fffe63460c6cee627ac8eae348aefcdae848e", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143648, "uuid": "b2f999a8-3cd0-42ac-8a63-1a0213ee9fd6", "comment": "Malware payload", "value": "cf692ef7e616c85111a0577b2fd4886c6c268fa8d3f5f985395344fdc730c70cf0b1d4b532be12484bd791269c26da0c", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143648, "uuid": "9a1e94a1-2de3-4789-b1a5-6bced50ae535", "value": "3BC4AE12A5629039F8B347B689FF594941AEBE90073464CB73C8996D5B7BAE03F30313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143648, "uuid": "115660f8-5f7c-4c26-9bfa-a695ba271f4e", "value": "adeae1388ccab7d5ea2c08a636428844", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143648, "uuid": "a8d837e6-60de-4fd5-bf8d-a8dd8fdaf2b0", "value": "12288:NbHAqgIuNsQBUTGlXA21Sp3vykrYIAtUfd+G+okZ:dBCNrU6/CakrYQdZ+hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143648, "uuid": "59fcf526-a088-4af5-85fb-06a3fa3c720c", "value": 576000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143648, "uuid": "c5ebb86d-2c9d-427e-b856-ae9deddff888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143648, "uuid": "3802a74e-11cc-4b23-b211-68be0d8f3256", "value": "7f721141b9a5d5ee1bedc9729e3b5003cb2d161305b046090495b036e590394e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d321de3-90f2-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617065618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617065618, "uuid": "ef9c2da6-d022-4590-af32-e368ed69709a", "comment": "Malware payload (Dridex)", "value": "5434013e0898f04179ededa65e1b6bd3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617065618, "uuid": "dcab4e27-0640-4cd2-ae41-e00c87d5f9b7", "comment": "Malware payload (Dridex)", "value": "7f890556f98e0b679b161d4ca1892b86e108f8ccc937754976f22dda011d5970", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617065618, "uuid": "ca600f9a-204b-4aa5-983f-693457ca0895", "comment": "Malware payload (Dridex)", "value": "3bf09a046ed25c45e366a00c91f4cadeb9d74c67", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617065618, "uuid": "ffd87cae-f56c-4bee-a075-3acaafc003f3", "comment": "Malware payload (Dridex)", "value": "2ed4f6012883efc4247dcc49e1070874bf217ef8e36af7c4fd6ec17e44ee570e7471f197f7a3681fe63230ddbca00a51", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617065618, "uuid": "a2ab8b0c-5953-4f13-9e1a-425f1b8867d3", "value": "D514AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A6FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617065618, "uuid": "e62ab1e7-8bdc-4707-ac75-5c79a836798f", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617065618, "uuid": "57f51ae5-c9aa-4233-afba-e9c3753c9fa6", "value": "3072:G1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Oi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617065618, "uuid": "4304003b-6736-4fb1-9ffa-ab01141c5c92", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617065618, "uuid": "fd1258ad-16d4-4f79-be4c-5f176006980d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617065618, "uuid": "05b3455b-f903-4d5f-b929-c6a5ffcccc73", "value": "7f890556f98e0b679b161d4ca1892b86e108f8ccc937754976f22dda011d5970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c32e1e-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617088562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088562, "uuid": "1bdd7ded-529e-4076-abcd-ce310cd0cc9a", "comment": "Malware payload (Dridex)", "value": "5e47d18f42add9b4f6887f63508894fc", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088562, "uuid": "a667957d-3bfc-45ed-bb66-8d533ea6db30", "comment": "Malware payload (Dridex)", "value": "8074446cec99a8dfde1de8710a6d0be20f698f4afab860ce82984929aedf5700", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088562, "uuid": "b8818cf6-a25f-4141-9097-0f9345bc259f", "comment": "Malware payload (Dridex)", "value": "8a0638518cba63216be659cd0d07793bd4320210", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088562, "uuid": "c7507eda-64e1-43b9-9c0f-975cbce0d959", "comment": "Malware payload (Dridex)", "value": "6008e3b799b51f7f81ec4de9ab750f5876e6dfc9f9da3393ce159aadb7dfa3b03a4f294401939cdb29bccdb0346aecf8", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088562, "uuid": "9b1ece35-9877-44f3-bd27-8f52f1216a43", "value": "32C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088562, "uuid": "40e8bd25-46d9-4e01-902f-dd12cc3c46ae", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088562, "uuid": "9b961f2d-84e9-4312-ba1d-8843b7a8da56", "value": "6144:9GiMOQpsduhD3AZHC/uNbExd+4ruwH1b0717WLmw6Xg6DqaIDnnlvgho5la:wVhDQZHC/uNY1/HRm8LYQOQlYql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088562, "uuid": "125a480a-8d32-4ccf-9e9c-24a6becdab80", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088562, "uuid": "b028430a-72a0-4612-b41b-aeed8b6c1676", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088562, "uuid": "cdd978bc-7f19-4c0d-ac13-0c68278466be", "value": "8074446cec99a8dfde1de8710a6d0be20f698f4afab860ce82984929aedf5700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8292f2-9148-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617102716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102716, "uuid": "bcce6b25-b308-432b-b048-e59e9e8e5c9f", "comment": "Malware payload", "value": "38fccc3e528ad0d37d4ad842a177c2a2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102716, "uuid": "df49690e-c8aa-4f93-9637-a186c8c09c8a", "comment": "Malware payload", "value": "80d7ab50aed6ab9e27bf65103b139cb0f54f8438ef4f831bf3c29f330f1f5eeb", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102716, "uuid": "d98cbce7-fac3-45b7-a2ab-0718fc0f3777", "comment": "Malware payload", "value": "9103e92eda7922b8f827392b9b9d1917f959e2a4", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102716, "uuid": "706c03bf-b7d7-4428-bdc7-27d32f7d22b8", "comment": "Malware payload", "value": "a986f4ef85d5c577fa6289e48fbc5a4f211a9a974a3f03f7e0e582f1e82dd55a85cd954f8b646179303fbc9ac8202bbd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102716, "uuid": "7aa173fd-29f9-4fe3-86b3-e4a094a16ff5", "value": "F0A5F95664A20F94C89D117980EB0F8637AEBB4A5106E76F4375F26F7FF33B49928801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102716, "uuid": "16f8144d-bf6f-4c80-bb75-982c85934d2a", "value": "1536:xaRR0nIcjELcISYFfSUjq/h/nSaJ2Bt36IaFpGB8:xcR0n9xLUS/nSp3EFpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102716, "uuid": "39c336ca-c38d-4ded-be99-e81ffffc3c40", "value": 2196683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102716, "uuid": "8f131625-cd53-4570-b206-01b94f76722a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102716, "uuid": "e37e85a7-3bef-4cfd-af95-ee2f796dc4f9", "value": "SOA MARCH 2021 INV0023.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d477c1c7-91a4-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142269, "uuid": "493d388b-d4ee-4611-9805-7bb9b1d4968a", "comment": "Malware payload", "value": "fe4c956d288a5a2bf2393e9f5c902a12", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142269, "uuid": "c713b6ac-1b5b-4075-8825-487a07637c8d", "comment": "Malware payload", "value": "81137fbab52c4152d3d879f25ff45b99e99bdbef96bf88b0af4a85a056cdea1a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142269, "uuid": "28252d4f-78b1-489d-a4c3-645b487fabc1", "comment": "Malware payload", "value": "187548135800a7500ef14db19923df26639e3c6c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142269, "uuid": "a70965c0-5401-480b-b4db-620594057356", "comment": "Malware payload", "value": "dc60f2cc5bf769264f633fc1c3646970dfd9ec5f371859a941256c174990b866a17e2e993a5469dcc2a6f5480f5fb34e", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142269, "uuid": "7daf16b7-2e80-4833-9e0c-0466e2e00fa5", "value": "FA14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142269, "uuid": "3ab0c869-f0c8-4dda-9e71-2e030c3981cb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142269, "uuid": "bea0624e-709d-48c5-8730-841e612c14ea", "value": "3072:d3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:dJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142269, "uuid": "edb1cec5-1fff-4b31-84dd-856f25889780", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142269, "uuid": "6e874d5b-ecdf-47e6-832a-0504e6d16f7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142269, "uuid": "a24259ca-0f0b-4937-b2e7-fddad2ffe823", "value": "81137fbab52c4152d3d879f25ff45b99e99bdbef96bf88b0af4a85a056cdea1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709a789a-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115043, "uuid": "26d33142-1b8d-4b9e-b1c4-4c9a999e44af", "comment": "Malware payload (Dridex)", "value": "233101a0d30d33e3000347c14838d75e", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115043, "uuid": "43ed780e-1b9a-4a87-8d4b-9e4ff3647159", "comment": "Malware payload (Dridex)", "value": "815f4684dda4c271af51bfed4b8f9b5bc7dada7bcca8a11d83f431e21dc909d0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115043, "uuid": "f7b3f400-f32f-4ca9-be1c-7d6ba773a026", "comment": "Malware payload (Dridex)", "value": "02910efffd3a001c62d60e9d3282bacd36c8600e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115043, "uuid": "ab26e272-013f-4d5f-9459-7eac413aaaaf", "comment": "Malware payload (Dridex)", "value": "a84d44b3bfcf6e72bb2a656d63465c32d3fc4800f0e1ea3a87207e8c1c4bd198ac76030bf516e646da2dcf3fb6408707", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115043, "uuid": "41c3bbf9-afc4-48dd-b93b-aadd4dfa5c33", "value": "B214BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115043, "uuid": "8dd74738-ea93-4b83-809a-46772be58cac", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115043, "uuid": "57686b57-4a00-44eb-a4ba-cb7793bbee42", "value": "3072:13PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:VJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115043, "uuid": "130c9688-f4cb-4dfe-a464-c56048af34d8", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115043, "uuid": "66e8c8c8-4caa-4e41-be6f-4e44e14f4e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115043, "uuid": "cd2339a4-d1dc-410b-91da-fa205b12c9da", "value": "815f4684dda4c271af51bfed4b8f9b5bc7dada7bcca8a11d83f431e21dc909d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec2c549-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143735, "uuid": "83162056-4cb1-4960-8f07-525427bfe64e", "comment": "Malware payload", "value": "f652b63eef20ce48bfc398dd74bf8460", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143735, "uuid": "397f3303-961a-4a1a-8a96-2deb5b29936d", "comment": "Malware payload", "value": "815fbd9317f6f3ea79d85e1c7e1e3f2a852163325354406b455f595bfd0f4ae5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143735, "uuid": "ce0acf8c-7a9b-47e4-894a-044abfb82d52", "comment": "Malware payload", "value": "788cb5cabe26b2eb95d390f68e41f04fe13ace19", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143735, "uuid": "bf104b1a-8b47-4a56-8a1b-fe433ebe1309", "comment": "Malware payload", "value": "3b700f3f65ee2f3a718a8215c3c27919e015d0e398e7870f8030b36747689c849ea52ea2e461fc5cae32c45d565e867d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143735, "uuid": "b6a84757-809f-48e2-9941-1b3539a78180", "value": "F714BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143735, "uuid": "c4b30dff-27cd-4f72-b2d2-067885a9d9b3", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143735, "uuid": "eaa241de-ffcd-4050-8eef-725def7fa0d3", "value": "3072:q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:OJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143735, "uuid": "c5cb8480-bd75-4261-ba29-cbfc51dc13e4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143735, "uuid": "fc854ede-8ace-457d-bff0-5ff4fa7647ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143735, "uuid": "e67af0b6-82ec-47d0-a497-49f08e9af967", "value": "815fbd9317f6f3ea79d85e1c7e1e3f2a852163325354406b455f595bfd0f4ae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea6acc9-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617106772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106772, "uuid": "48181a03-ec6c-4440-8c5c-c9f2e820c401", "comment": "Malware payload (SnakeKeylogger)", "value": "7b15fbed447a2b9dde0b77851cd8f48f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106772, "uuid": "4a05946b-6d48-411b-a6fa-9ec4f677cd65", "comment": "Malware payload (SnakeKeylogger)", "value": "81d6b1d3f6524acdc3c7280e11b3ff43ea0f9cd7a2ccdaa6283de2ea28d74dfc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106772, "uuid": "897132a4-3e2a-436b-9e0a-57d2f6cc58ed", "comment": "Malware payload (SnakeKeylogger)", "value": "0379189541b35385d7c1dc21a06ecf6738a52468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106772, "uuid": "b392075b-2c9c-40c9-9317-12f128be9c8d", "comment": "Malware payload (SnakeKeylogger)", "value": "09356bda3a011e518a92cab9472334317732833d907691088f5563ddc50ac4a004e3e52b21c684367bb2a3682f79ead0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106772, "uuid": "b60ceb78-56ed-40eb-8947-256e2219c887", "value": "181527A8709E445CEEB8A634F5B18A871FD915321E92FF7F28E657002CA3779F94E410", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106772, "uuid": "d7b96988-6eaa-439a-80d5-ddfe7a4a388a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106772, "uuid": "ffa73deb-1aa5-4740-b326-d4b74ae75e11", "value": "12288:2HHz45YsSedkGyVTkezvFKt3rQkT9t6Kvy3ZgdfB6hnJxT5t:2HTAYslgVrzNwkkTTGgdfB6hnJxT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106772, "uuid": "80b97b6c-8e19-4b43-9068-6274132b7101", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106772, "uuid": "ac0ab772-ab13-48dc-aa67-86ce97aad380", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106772, "uuid": "0a60b3dc-9b8c-473e-ae46-487691c5fcfb", "value": "New Quotation. pdf_______________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798c89e1-91b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617148129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148129, "uuid": "cae1be94-a398-4ce7-ac93-d3c58d136632", "comment": "Malware payload", "value": "79a5c5ff71d01c09d2e65b920f520227", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148129, "uuid": "e15077c4-38d2-4df1-bf22-2600f295b04c", "comment": "Malware payload", "value": "824aeb9d9942b25134130a0abb4f864f1f76d54557908b01e61e371ad0786ede", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148129, "uuid": "f602460d-6d77-47c5-9714-d8f3cc5581e8", "comment": "Malware payload", "value": "559f9e0c311f06cea20c31781084f4e91c55b61d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148129, "uuid": "2aee681f-b532-4994-b8c8-b6c869e00e46", "comment": "Malware payload", "value": "a0c21ba090acac5413a8cbd4f3c1bef7718a48adb63b93c2189ef2f6568908c5d32490c395c6fda34a39213145e733b0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148129, "uuid": "300e4d1e-d8ab-4283-ad0b-8147a7f45c4e", "value": "7C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148129, "uuid": "d037df4f-6245-4dfc-8693-359d515b9a3d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148129, "uuid": "ad3d82a9-6490-4439-b7b5-5e81ebc049ce", "value": "3072:W3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:SJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617148129, "uuid": "0f7c0905-2857-48fc-a06b-615c70470a0b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617148129, "uuid": "422aa6fa-b583-4459-b8e5-038fa2882ca6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148129, "uuid": "ebc77097-3ca6-41d9-b5db-4f218c644fe3", "value": "824aeb9d9942b25134130a0abb4f864f1f76d54557908b01e61e371ad0786ede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf9dd58-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114124, "uuid": "9dd554c8-1c6f-43f2-9916-7496deede80a", "comment": "Malware payload (Dridex)", "value": "9d39112a9ff30315e154db02effb1faa", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114124, "uuid": "54ce71ae-dfa7-45b7-885c-b14074c54562", "comment": "Malware payload (Dridex)", "value": "82b3e470afd38eafaa36f2d28041ebee8914d1c3471f7ef12ff35100f1c2c1d0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114124, "uuid": "836646d4-58dc-4245-9838-90400b3f4097", "comment": "Malware payload (Dridex)", "value": "5a8b88cae3c626b73df2d702bb1e1ac8c62af4a3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114124, "uuid": "859a8e9b-a024-4679-abea-add0449e424f", "comment": "Malware payload (Dridex)", "value": "9794ffa575c12fc8b97e128118bacad7b691c8168d4452faa2a6ea2c50fa01af5ef295e4019483684204f25e7693cc15", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114124, "uuid": "01a540ff-9957-4d5f-927b-f70f04de76d8", "value": "6014BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114124, "uuid": "d453535c-a81c-4bed-9dc0-b87770f00f8c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114124, "uuid": "33d272bf-3bad-44ff-aa45-be292a426347", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114124, "uuid": "cade65dc-bfb2-4985-b567-f0278eed51b3", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114124, "uuid": "7571f8df-da24-4648-a3fd-9cc69a7f87b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114124, "uuid": "efaf3642-23dc-4cd2-ab61-fe19804095fb", "value": "82b3e470afd38eafaa36f2d28041ebee8914d1c3471f7ef12ff35100f1c2c1d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382bc942-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121820, "uuid": "e9fbaab1-d680-4fda-a11c-d673b9f0341c", "comment": "Malware payload (Dridex)", "value": "5ad91dc424aa819bd737a3e313450c44", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121820, "uuid": "644d8363-4a7f-402a-9774-9f47fec07c22", "comment": "Malware payload (Dridex)", "value": "831ee41193baa10adb86dcc9c3cff78a677b538122c4cc594829da7b4f445cd0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121820, "uuid": "d07d6dca-c48a-4b20-a59a-946c7db94b52", "comment": "Malware payload (Dridex)", "value": "270718b4400666d6554c92a8fa2138d451e8c054", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121820, "uuid": "d9278bc8-0237-4258-adde-c84baa2afc47", "comment": "Malware payload (Dridex)", "value": "9ddeedc4b736685974c39a8ce0d0a3e51593b4481b3576617cd1d8b6e0e8f2514456511aca13fd456159924997d02d5c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121820, "uuid": "202d2069-d016-4ecd-8eb0-3559cd24cbd6", "value": "8F14BE2DE333D495FFF7CAF41492AA2A8A7B2D40822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121820, "uuid": "478c6380-0827-4b6a-9ae4-e4aeb2d3e1e1", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121820, "uuid": "3665f029-d04f-4fef-b0ea-62cbba9a1365", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121820, "uuid": "28102a70-a386-4a40-ad30-097c63ce5e44", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121820, "uuid": "720ad1f2-7e3f-4241-af7d-86ab51c59022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121820, "uuid": "361f1f90-48ba-4970-b07a-682d19da517b", "value": "831ee41193baa10adb86dcc9c3cff78a677b538122c4cc594829da7b4f445cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3c430e-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120376, "uuid": "95d2283a-d6b4-4838-ac55-d3023f18456c", "comment": "Malware payload (IcedID)", "value": "3fe67140238acf401f9405b953c11791", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120376, "uuid": "904c876f-c199-4663-9ff0-f98d8da5abaf", "comment": "Malware payload (IcedID)", "value": "836ce52eba89e58a4cc034f2bd122095f72f00e5afce5a8431a9a2f2d7e2b7e5", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120376, "uuid": "d45fc81b-46ef-4d08-bad7-d98217e3891c", "comment": "Malware payload (IcedID)", "value": "a1a4f7893cd880543608418ad701c41f78b8c95b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120376, "uuid": "d8f57b4a-c9f4-44df-8f71-92d79c458ef2", "comment": "Malware payload (IcedID)", "value": "08e6b5b303ca089360676af93d246e58d1fab9db589f3843e6406f5b609c441cb31ff1946513d7ce61161c22c9f09d70", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120376, "uuid": "6d44b4a7-a28e-4408-a39b-274e17e043e6", "value": "36B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120376, "uuid": "b5c5dfd5-d27f-4f9f-b875-cf27d66f59c4", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120376, "uuid": "ef30c754-05ae-4d1f-ab42-6b2701781d2a", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120376, "uuid": "eae9176d-1b47-499a-a9cf-961fa2f31625", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120376, "uuid": "90cf625b-844f-45fd-a332-f7d4903d7458", "value": "document-808765513.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0355bca-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120357, "uuid": "9870a4e3-af2d-4d78-99f0-2a7045940e3d", "comment": "Malware payload (Dridex)", "value": "b1a93d3c10dfe58ff66b5b8c123ec272", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120357, "uuid": "829ac34e-0659-40f2-be1c-5aba66b75b1c", "comment": "Malware payload (Dridex)", "value": "83799aed7a4f1eef9d72ee8016f4acc8b60046ec1ef7303dce9e95390ce5ee97", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120357, "uuid": "358a517a-108b-4096-b392-3d0c28ee49f9", "comment": "Malware payload (Dridex)", "value": "c559919a003f5b32273b5e7dccf767f2e0c610e6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120357, "uuid": "571a43e2-4a35-4c37-89aa-de20b4cdb728", "comment": "Malware payload (Dridex)", "value": "46efa477ed4be5e6b45f39b93ffec55750c8c200d5ee5f5c031dd65355fb9f4769198b8750c09fea5deadb73d047bd6a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120357, "uuid": "614346b7-d0df-4c03-93d2-4083c8c180c5", "value": "EF14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120357, "uuid": "581b7b9e-9f44-4ce4-9d1a-3278bd9590cf", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120357, "uuid": "eeffbeef-ace7-4d84-b5cb-efc5061b9ae5", "value": "3072:t3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:NJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120357, "uuid": "06223cd2-cd82-46f0-b3c3-802cc91c6052", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120357, "uuid": "8372302e-d6a7-44ae-8fe5-f97f8194c7a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120357, "uuid": "68734e4c-72d2-4e90-8b5c-b2ac4203789b", "value": "83799aed7a4f1eef9d72ee8016f4acc8b60046ec1ef7303dce9e95390ce5ee97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c1f2d6a-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617105479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105479, "uuid": "67912239-3281-4835-85d8-af24544fe391", "comment": "Malware payload (AgentTesla)", "value": "530fc3691ee5f73412744c96c8701f47", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105479, "uuid": "1b298138-8619-4c8a-a399-920652f93561", "comment": "Malware payload (AgentTesla)", "value": "83d399805ca88bcebde0f746b856adef9e8d12f2860ab15dbe22c82f30066387", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105479, "uuid": "48880105-9e33-47b8-93b3-7f2d1d809f6c", "comment": "Malware payload (AgentTesla)", "value": "2c83b220184ee7532445cba7f8fc4bbfe56cf733", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105479, "uuid": "6fcecc47-4ec1-473b-91ba-cadbf9857a76", "comment": "Malware payload (AgentTesla)", "value": "feb4683294bda90f09d00a8acd024b91b082f5005c3c7bfd1deec4aaa84b6477e564409921cd75a513dacbc55a172ec9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105479, "uuid": "22381239-ef66-40d3-b8c0-9f84f62f6f2c", "value": "7F7472ACC19747EC8FC9B7B46A1A1F891208B76DE384E5533638A7712B93C7B9407874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105479, "uuid": "c2598198-9d3a-4add-9985-70f5b2385807", "value": "6144:6K1K1ACF46teXFbEfv6SOpnxNNSnHTdp/MnWANdm4Gdpr/gxrP:T1KmCFqJgyToTvIWtdp7AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105479, "uuid": "398c374e-b203-482e-935f-00fc7ecb7055", "value": 367565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105479, "uuid": "002f2034-d2c0-4206-8334-01207e75406f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105479, "uuid": "56ca673d-ead0-40b8-8d4e-7d797a78c701", "value": "new order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70556749-9170-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119767, "uuid": "d5b79b64-a736-48f6-b79f-00aa8f7a45ba", "comment": "Malware payload (IcedID)", "value": "31f05136f3897c1840cd66523d81b601", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119767, "uuid": "5090a150-e1b5-41eb-b8bd-e7b9e3ac36f2", "comment": "Malware payload (IcedID)", "value": "8408f0c4240b6e216efb20d22432740a772872eea59dbacd8b10d4e14dab4996", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119767, "uuid": "0f194d18-0127-41b7-a375-a4f073cc1cd9", "comment": "Malware payload (IcedID)", "value": "17ac33ee87004376c28c587a9897ebcd99dd76b0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119767, "uuid": "bdd55c25-ec46-4c5f-8e30-ade03c2b492e", "comment": "Malware payload (IcedID)", "value": "4624a69bcd06af5fe7eeb4c2621291855caf890ffd42c4fdc75613f0859ee81ba67915f4d3fb8bdf5dda7cb2d031def6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119767, "uuid": "f0f76232-666e-4d6b-80d7-6804bd37364b", "value": "0AB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119767, "uuid": "10d4dfdf-3c5d-47db-869c-fd4f8e4c2d3f", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119767, "uuid": "ed4bb7b9-ffb2-481c-826c-7909a742687b", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119767, "uuid": "a6ed9d33-eb0c-4230-a40f-52ff7c1109dd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119767, "uuid": "eb623308-8542-4b1e-b770-a8abb13dd16d", "value": "document-1887980204.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30944007-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120089, "uuid": "eab19363-08b2-4038-beeb-87e8aaba9edf", "comment": "Malware payload (IcedID)", "value": "a7d7f0fe97073da72d72367cb1b2c90f", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120089, "uuid": "f184ab36-2145-42c6-8315-3bae3aecdb38", "comment": "Malware payload (IcedID)", "value": "8431c3acae904aebb2e9d5ad80fb5bbd0728cd80da4c1ddec4c7c2f74b1406fe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120089, "uuid": "4592a4ea-c6b5-4d20-8bbf-950394c1ceb2", "comment": "Malware payload (IcedID)", "value": "44db8eaa5283a51315a6a9a437f0447ba5af5c2d", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120089, "uuid": "e87097e7-ff6d-475b-a29e-44598691881b", "comment": "Malware payload (IcedID)", "value": "2412a940ceaea777f457652ca98ccdd296ffd9099cf0b2cd2af563cd5a70798b968d99a26d67fd8f7862baa702c1d0af", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120089, "uuid": "9d8c48c2-02b3-4113-b79d-acb1b619b7e3", "value": "EEB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120089, "uuid": "0e8efc62-5c3b-4db4-aa9a-25d280e5ae36", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120089, "uuid": "e74fbce4-28f3-4f2f-8da7-1d0f0d331940", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120089, "uuid": "1253d685-05ce-4831-a7f6-f4c4856ca395", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120089, "uuid": "baad2450-a6b4-4225-a55c-1f1ec25e744f", "value": "document-1649966948.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f053467-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617088492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088492, "uuid": "e13c1fcb-6754-423e-a193-021b46800969", "comment": "Malware payload (Dridex)", "value": "251854d69a777b08fbdcd61ab802c1b4", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088492, "uuid": "f45b79fa-34cc-433c-bfad-d16588a8cdf8", "comment": "Malware payload (Dridex)", "value": "84a553b3db777b5d651fc07d721a57ab410d43571143cd665a061239b094bf16", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088492, "uuid": "5caf6fbe-1284-43fc-981a-ba2af4336022", "comment": "Malware payload (Dridex)", "value": "553bc08c625e15f38bb523ec2cf311a6305f42f1", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088492, "uuid": "715cba21-91b2-4bc6-bf85-300175d2ae0d", "comment": "Malware payload (Dridex)", "value": "c173cf6173a9c3fc1b3cde1bb21e3b71c1ec68eb0f942401611d8fa25211489ab94ff9e50f9b76af7b8cb8c92c54460a", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088492, "uuid": "d4ed0ca2-d5e0-49fa-908a-b0d7d765bbf7", "value": "5EC4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088492, "uuid": "ffc7c4f8-c836-49ba-9309-cd588e9efd96", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088492, "uuid": "b6eb46d2-69f4-4ad9-af70-98a094bdfac3", "value": "6144:OGiMOQpsduhD3AZHC/uNbExd+4cuwL1b0717WLmw6Xg6DqaIDnnlvghJ5la:/VhDQZHC/uNYe/LRm8LYQOQlYll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088492, "uuid": "57bf5797-cfcf-4918-a6b2-d8d4fe0e9a82", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088492, "uuid": "965a2505-cbb1-4408-b03e-02b3a97f355e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088492, "uuid": "16d10be4-d2d3-4efd-9ed4-5e87597a7cbb", "value": "84a553b3db777b5d651fc07d721a57ab410d43571143cd665a061239b094bf16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f665d3b9-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115267, "uuid": "d571875c-1b59-44fa-ad9c-be85437bca78", "comment": "Malware payload (Dridex)", "value": "57d58ca2fc481f425b11e32999d93756", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115267, "uuid": "15992d80-df29-4d43-9e3b-1ff04498a328", "comment": "Malware payload (Dridex)", "value": "84bf2254ce49512707d8a498bba102484e233a1e910c43c43e30a70b371db8ee", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115267, "uuid": "c972f240-819d-4b60-baeb-8429c0ae48a6", "comment": "Malware payload (Dridex)", "value": "e4eaa16d6f60cce7eeeeb9e200fd4e60043ac437", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115267, "uuid": "10492da3-c1b5-466b-8e4a-07794bd4c36d", "comment": "Malware payload (Dridex)", "value": "d1a878e92d33c2e58bd32297d1c708e2b3b01549310bed506dc639f95f80d73f4c5e432c255c51bc312de4b94cb625d5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115267, "uuid": "b4f1bf3b-305b-4509-847c-78461964c63a", "value": "B114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115267, "uuid": "4b1a8511-5b07-4f58-97d0-c3eecba1ecfd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115267, "uuid": "85ab548c-3d7d-435f-b826-928b714a6498", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115267, "uuid": "4d31fd29-55c9-47fa-923b-713d270a89da", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115267, "uuid": "24958939-f83f-4acc-87bc-26f4fc2f934a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115267, "uuid": "5c69223a-7c82-4289-a4c9-468e2b3f9485", "value": "84bf2254ce49512707d8a498bba102484e233a1e910c43c43e30a70b371db8ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cfff13-9157-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617108898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108898, "uuid": "70341be4-3aab-48e0-a9a4-e63db25e65f6", "comment": "Malware payload (Gozi)", "value": "940166b8bf5d266e590bfdf58d5f3696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108898, "uuid": "c242a69d-953f-4ee5-b9d1-b4355b730914", "comment": "Malware payload (Gozi)", "value": "85d535a2051a60c54a1f2f43ce8854f51a784e87a7a9a5a337567fe3296d81a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108898, "uuid": "9883c472-e577-4b41-820a-d86848c15a29", "comment": "Malware payload (Gozi)", "value": "bbc0978f0865a01e50ac36a349843011ca0070f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108898, "uuid": "b79d28a6-fc7d-4934-97e1-2871e4017aab", "comment": "Malware payload (Gozi)", "value": "8114d42671c0f6b608bf976c6d5f031024ce19cd3fbdb37f7ea7ec9c08a39e687f6aa1c93c4e1948f6c6b89ce4a64b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108898, "uuid": "936df755-ae53-4883-a7fb-a22672fd2589", "value": "77948EA06C59D6FDF7E7E87FE86846E1950C5801DFA4E09B234E23C0AF7A7C09A36055", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108898, "uuid": "fee8c40f-cc09-4ec4-b364-33282f489116", "value": "3226312c34224ab69ec01b25a39f0ee7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108898, "uuid": "32d46474-2b7c-4d22-a36c-acf01d2e746b", "value": "6144:pqiapg0Kg8wmC5ysfWCIGalxb99PhXReueBajO6weVY4jTjzwW9VzgP38+se5b:Zsg0Kg84yhJnBfjNwz4jfEW9W9sg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108898, "uuid": "4059cd46-add2-4f11-85fc-dc4961e382b5", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108898, "uuid": "ffb187e4-15d2-4f4d-92af-0a54882207c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108898, "uuid": "e36e99d0-0520-4720-82ce-cea79c683de6", "value": "940166b8bf5d266e590bfdf58d5f3696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "539d7645-9175-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617121866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121866, "uuid": "bfdfc1f8-d6bf-4953-a9b3-b3b8fd85652d", "comment": "Malware payload (Dridex)", "value": "c39e969045a8b7c08c837c0927e31602", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121866, "uuid": "5eeedb12-b5ba-4952-8d80-bfd509eec755", "comment": "Malware payload (Dridex)", "value": "86116ebf4f0af64f2fab1f91df7d32a1a2760e84fcbbc8df138fd38ac5927e32", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121866, "uuid": "25ce5a95-d263-4a15-b9bb-957e7e0df732", "comment": "Malware payload (Dridex)", "value": "7987f34193df1e9e738009a1323abfd44fcc9017", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121866, "uuid": "8d876f0d-b58f-4906-bdc0-59acef8a9aa1", "comment": "Malware payload (Dridex)", "value": "89d929417acd4f8fc51e36c15a5ec1bc7b3747e0f9841ae2d080b8f5f1dd1264255822e9822c7eeff144c38a9f1ef1fd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121866, "uuid": "64c5ad39-c8cc-40ab-817f-cec1afa0f5f6", "value": "6D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121866, "uuid": "f7ec84a2-9297-4975-b52e-2d3b5fb14d0c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121866, "uuid": "803c2578-19bc-4768-94ca-938782b5d375", "value": "3072:Y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:cJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121866, "uuid": "0175c1e3-16d6-46e2-a5b7-d083ad1df526", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121866, "uuid": "5a3cf23f-2030-461b-a16e-6c0437f3805a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121866, "uuid": "5b9b73db-f8bd-427d-aec6-c13666e5d38d", "value": "86116ebf4f0af64f2fab1f91df7d32a1a2760e84fcbbc8df138fd38ac5927e32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e31deeb-9187-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617129588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129588, "uuid": "31afc83d-1e36-460a-b2c7-584096204717", "comment": "Malware payload (IcedID)", "value": "3f4c96957d23b39465ee619de5c3fc82", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129588, "uuid": "8d409bf6-85bb-423f-a45b-7e18d296de16", "comment": "Malware payload (IcedID)", "value": "863c896d4b78a725eda2fe8e462a08e2ffc857b0b9387bf701a972b0aa1a705e", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129588, "uuid": "7def9a86-f72e-4eda-bf05-962bd4d5b179", "comment": "Malware payload (IcedID)", "value": "561eb3cd76f89122350751ab93842d7be55b1407", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129588, "uuid": "7f149a2a-8d51-481d-9f7e-a9b1bd520189", "comment": "Malware payload (IcedID)", "value": "ca61ad517f8d6ef66072840cf997f512c112bf73270d7db08cb52dd010030909883480c98297668d578cca0c8c4b4fd1", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129588, "uuid": "198795e0-030d-4b8a-a9cd-8ef2fe1a5b47", "value": "6FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129588, "uuid": "170f1e9b-ab54-4c86-8f97-c45969af898b", "value": "3072:Y2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:YzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129588, "uuid": "8b4a8f04-e104-429a-bb5b-0064ad9baebd", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129588, "uuid": "94dfa6b4-195f-4c1f-a93e-ffc8ce4bda73", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129588, "uuid": "837bf09e-fea9-4a4a-8cf4-d6bd044ce7c2", "value": "document-1094893890.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82626d58-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126239, "uuid": "297126e6-6ae8-48a0-b516-40d350d28063", "comment": "Malware payload (IcedID)", "value": "24f30297fe1ed488fafa3a6ae4f7a9a4", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126239, "uuid": "c82c77b2-d7ca-4234-ae7e-418fc6d39d33", "comment": "Malware payload (IcedID)", "value": "8642aebdbd2d80d0ffe9dde890806bc62f9dae1bb204fd9473cc713ad93f5d94", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126239, "uuid": "efad64d1-7335-4620-bbce-057b583ca42f", "comment": "Malware payload (IcedID)", "value": "1badd579347ab18a59cafb73629b2c0b99ac31cd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126239, "uuid": "7808ab2a-b19e-4840-aac7-5b37c68ab4cf", "comment": "Malware payload (IcedID)", "value": "ae75d0780b2242c4e124fa7700c5a872e8ea23dc629f13622003d010239439be4f4f36cd81c59d96f992b46c59417166", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126239, "uuid": "07c1f684-c97d-4e95-a942-45861843a6c1", "value": "3EB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126239, "uuid": "5fb82747-a457-47dd-aed9-36b08252d8f2", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126239, "uuid": "70ffbf15-a680-406e-b8ef-25405c60dc1e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126239, "uuid": "64c701df-f89b-4d88-b39b-b9ae45c27777", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126239, "uuid": "c16ce07a-f4b1-4ec6-8c73-dba309a04816", "value": "document-303430024.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff79ecc4-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617106692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106692, "uuid": "6c7659ae-cde8-4bb7-a930-afa703e78f84", "comment": "Malware payload (AgentTesla)", "value": "0c7f488392160de57038252ab7a35ecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106692, "uuid": "0fcd6706-9894-4b31-bded-9e35120d53e2", "comment": "Malware payload (AgentTesla)", "value": "866aae77aac5ac5f4b6bae2e93d42231c5d47c5c9d8c030310bcc4c05a465b49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106692, "uuid": "9e32aa17-1dca-4b69-8aaf-e18a0766217c", "comment": "Malware payload (AgentTesla)", "value": "b023857caa93c70e69f81b4960a5c7325a42739a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106692, "uuid": "3a9aa754-6d3e-4194-bfc2-5a23b77d613b", "comment": "Malware payload (AgentTesla)", "value": "bd773825785d22fd1003d071c6331f319a3187d579985360944bba84b29da010d2cea6b003804e3682c62b566a2d85fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106692, "uuid": "8840ef20-682d-4357-9a52-69410be9ec92", "value": "71E4A4A870AE805CEEB46634F5B595821FC969321F62FF3F28D667006C63779F94E810", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106692, "uuid": "bea50abf-cedb-4736-ab1d-5584eede7b16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106692, "uuid": "3da6136e-76f0-4150-9160-2399d9595fcd", "value": "12288:V48JStKZDl0L2nK/HFVBh9HSLIrZzOLmNeP/LblC:jdBkNVj9y4OJP/nl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106692, "uuid": "95cc3a52-1bb1-47a6-b8c4-fb0afc2ba488", "value": 669696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106692, "uuid": "b15793cc-5487-4bd3-8e97-717dd965ef1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106692, "uuid": "6fa9fbcd-a346-49c1-b4cf-f22bb24c65e1", "value": "Stock Materials.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43e4d19-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122887, "uuid": "d8308ece-4111-4acd-87c6-c5bb6098edba", "comment": "Malware payload (Dridex)", "value": "32393f0807d8c43dad3c0cdcd876b2b4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122887, "uuid": "ff9546ce-66b4-4088-b656-9c9c2cc18be0", "comment": "Malware payload (Dridex)", "value": "86eec5cfff606c04bd8535294a3d89293dea5cd52b90663c66ac92b4a7134c06", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122887, "uuid": "a6c6a9e5-992e-47b5-863d-39dc8662919e", "comment": "Malware payload (Dridex)", "value": "f5fa77d2f942e7007638b35b9d21a3dd336dba0a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122887, "uuid": "da972745-9c2a-478b-8cd7-5b5f42d3dae3", "comment": "Malware payload (Dridex)", "value": "a376b098950a88c43f83e58271b0b07b6f5e210274b5931b77491efbf7ad4b642b4f2f39707d651a3ca27ac829547236", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122887, "uuid": "523c6682-d03c-4c3a-a3b8-c0d3226ac5e5", "value": "1814BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122887, "uuid": "6ba1315f-693d-4cee-8e83-4c4430f1db5a", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122887, "uuid": "8a5581f5-a2f7-4407-ab7c-11d2402881ee", "value": "3072:g3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:kJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122887, "uuid": "db5aeaf0-7800-4730-b373-02b83dd70f20", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122887, "uuid": "4633ef01-4973-4905-917f-3bcb7ac02e51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122887, "uuid": "667ad74f-a64b-4857-a84a-cbaa907c6747", "value": "86eec5cfff606c04bd8535294a3d89293dea5cd52b90663c66ac92b4a7134c06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81af5d1d-915a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617110347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110347, "uuid": "93eb9c23-6edb-4b86-a264-cbb0eca20da3", "comment": "Malware payload (Dridex)", "value": "73825d80954f3e2a2d3f259bda3c56ed", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110347, "uuid": "fe9e4a2d-e452-4d89-9d9a-3b5069b51cf2", "comment": "Malware payload (Dridex)", "value": "8722496dc748b5dc20eda53e17510042923cecfcf607a1f30bd7d9d6f71677b3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110347, "uuid": "bc71e5eb-fe49-42f0-8e6e-eee40d36e3fd", "comment": "Malware payload (Dridex)", "value": "ec8776bd245b585c87e0cffdb4eeb2aac27e0450", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110347, "uuid": "08c3f740-86d8-4797-a41b-c8aae6259bda", "comment": "Malware payload (Dridex)", "value": "eb0aac4400408c580fdfa6bbf8f4f64a4a9236303b93b71b1602451050001558b78cc384c2511b2d8dbba524a427e7cd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110347, "uuid": "d5101358-e70e-4a19-b751-7c7854404864", "value": "E414AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110347, "uuid": "4a861ad8-dd4a-4769-b622-218584cde564", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110347, "uuid": "732dea5a-a1ae-471b-be3a-ba2764df9343", "value": "3072:31i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Fi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617110347, "uuid": "3325321d-4e97-4382-aa05-7ba3dca2566d", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617110347, "uuid": "02f542a3-f3e4-44be-8a6e-9e9e3dfc9917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110347, "uuid": "715b32a5-a8a3-4068-8949-01ba3cd74c30", "value": "8722496dc748b5dc20eda53e17510042923cecfcf607a1f30bd7d9d6f71677b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e69f335-91b2-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617148110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148110, "uuid": "ffa80bab-b516-454c-8a45-18405b78a5e4", "comment": "Malware payload", "value": "6e1dd7632c344957473d6715f297de0d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148110, "uuid": "f21420ed-02ea-4a84-9ec5-24f5418dadea", "comment": "Malware payload", "value": "87a7e9766a5d58c086f13e918cea3a5676d1c4a76c389712f4de6551d0c29e2b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148110, "uuid": "51b6895d-bb8d-4f61-98a2-46f86e236933", "comment": "Malware payload", "value": "0d16d67d4ab06e39e5d10c4b1637f13daf7c9104", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617148110, "uuid": "92565b7c-21f9-417e-a3c1-5404350eaaf2", "comment": "Malware payload", "value": "acafb33b40424cbb6e7b8faff71fde34e4f8fb25dfc52dd155d1247e84947a63d91ae61c22b193ab3653cc682f4ff1ad", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148110, "uuid": "21f62894-153a-4220-b0e4-f4227a38e9a9", "value": "1A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148110, "uuid": "486c2bf4-16db-4f68-ac55-ba6f54a57a3d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148110, "uuid": "d2b32936-cae1-4238-8ac6-e90f84e964b3", "value": "3072:L3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:LJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617148110, "uuid": "16534759-7bfe-4fd2-8738-0b6042a25154", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617148110, "uuid": "48ac8492-84b9-48ca-aae9-799fb7f0623b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617148110, "uuid": "123497e2-16a6-4608-b2a1-0e01abfe9285", "value": "87a7e9766a5d58c086f13e918cea3a5676d1c4a76c389712f4de6551d0c29e2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d6173e0-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617105508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105508, "uuid": "9f649231-6715-4aa5-9acb-b37b4757e103", "comment": "Malware payload (AgentTesla)", "value": "0ee7a74bee0110b23f6066f084a5c4a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105508, "uuid": "b63f4314-292a-4edc-9ef1-cd3e5d1c2f6e", "comment": "Malware payload (AgentTesla)", "value": "87e099969395eac5eea1c52c30ebdd55d69338026ec5bcfe3d6f93dfadc5fa26", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105508, "uuid": "5806306d-0299-45df-879f-a0b6c8f515ac", "comment": "Malware payload (AgentTesla)", "value": "fdba7639c988270665661950951eff993a143099", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105508, "uuid": "6821733d-2d2a-4a78-9bc0-4bcbb000c85e", "comment": "Malware payload (AgentTesla)", "value": "ef8801ed31b51360dd2a8ddc6442ff27e4182b7423640de89432ed6e953fe2177ae5ff1dcee803876f2cf5957ec8168e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HostGator", "colour": "#37D324", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105508, "uuid": "ab8bc144-fc77-430d-8c1c-1f8c1fd39b50", "value": "4FD4AFBC76047DE6266F536BCA96BCDD03B5266299CBA8CD4065B7C305A3335FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105508, "uuid": "25fd61de-7322-41e4-afcc-f20a20f26dea", "value": "12288:B6CDJ1l7fEP4QBNaGpUvvj83+hWjZHOIKcnT6nR7z451Pryy/NvukIxk2b9xk3g:kKX7EP4uAUUvvjAZK/R7zw5ry+296g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105508, "uuid": "8de4b8ea-2a2b-47da-aad0-65d1ce8164d7", "value": 624904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105508, "uuid": "7d1d3313-e621-46b2-9005-75bb824d7858", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105508, "uuid": "acaf3959-8477-4f6f-9ac6-ee1ebb556129", "value": "to Forges Tardieu SL20211140003 P67049_RFQ valves.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373161f1-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120959, "uuid": "6a1fc247-6956-4468-b3da-7d1637b99047", "comment": "Malware payload (IcedID)", "value": "d0137c2a6eda6afc28b4474d949d6b12", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120959, "uuid": "7ddb7a34-bb4e-4d0e-94b7-a176d10b673c", "comment": "Malware payload (IcedID)", "value": "88025abee384edcdb44c82686b8fe907a5ea1aca5f5ff733b912abe6a8354fa2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120959, "uuid": "3333eaed-d9a8-49b1-b3af-2535acbe7d6c", "comment": "Malware payload (IcedID)", "value": "20206f332cba9bcac66c5293a69a7924072c983b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120959, "uuid": "67235598-765e-4b24-b2d1-518f86c61ced", "comment": "Malware payload (IcedID)", "value": "f0d7abf580850d657bb45ce8b9065e9fb1434ce7abeba8f2ef293aa5881bc541668a1b0a35dd75e48062e24f37a0c9c2", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120959, "uuid": "f3bb9e5e-54bf-48d3-99a2-27d3eff0629b", "value": "B5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120959, "uuid": "ef8e43e4-4bac-4a27-acc3-f53b7fd99a9d", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120959, "uuid": "cba4eb25-441c-418b-8dc8-059f8c13ab05", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120959, "uuid": "a4f8edd4-f4f5-4a83-b6af-54f181399fd4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120959, "uuid": "99c4ab94-9fec-4a6a-b601-a6c1822c0d28", "value": "document-1599579719.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f1b881-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127161, "uuid": "cba79af9-417d-458b-9c71-ab99d36ec5cc", "comment": "Malware payload (IcedID)", "value": "5ec1d4eff4d5e078a85736d6cc969503", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127161, "uuid": "df3f4d5a-ee65-4107-a90e-2f7ba1effc07", "comment": "Malware payload (IcedID)", "value": "8807e366742990868bfb2e8f02cab185271bed2cc5b99f3c1e3187a698b94fd8", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127161, "uuid": "2618889c-5c70-4383-aee8-ec1d374e4b6a", "comment": "Malware payload (IcedID)", "value": "9bd8f3425229f8ba677b318b1e1743710039588a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127161, "uuid": "96fccd7f-f9f4-42df-8b6f-19712d292655", "comment": "Malware payload (IcedID)", "value": "153193664aeb3a1fb31f4b9d2d33be33718e57c56e99c02124ccede49b5d85f3991e039c6e9fdb09709f8e14b5084f91", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127161, "uuid": "42adb1da-9980-4897-8e61-2a8e25525ca2", "value": "8CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127161, "uuid": "7b95dd2b-a286-4892-a14a-bcffa8677ae8", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127161, "uuid": "a456466b-1911-46db-ba96-38eb87c433c4", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127161, "uuid": "93b314c8-0b84-4289-9912-ea5c239e43a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127161, "uuid": "4bcd704f-76f3-4039-b520-ac4b02f558bf", "value": "document-1725097927.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8066dc1-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617082923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082923, "uuid": "e9c666c8-e8d7-4c1a-aa30-03260c2b3fbc", "comment": "Malware payload (AgentTesla)", "value": "5aba40977708b28a51ef020e9666dfeb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082923, "uuid": "931ad7c6-6f99-44fb-864c-a4c008dd220c", "comment": "Malware payload (AgentTesla)", "value": "8824a401cf41d728889264ba415754fe55033325e9e0d8e056e1166fd2f2372b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082923, "uuid": "10c5dc2a-810d-49b4-8ee1-c15d9ab0e777", "comment": "Malware payload (AgentTesla)", "value": "9f8669030f3b157237f4bebeeb3ba5a6cefb2071", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082923, "uuid": "f573365e-be01-4b0e-834a-7f25c38ae4f3", "comment": "Malware payload (AgentTesla)", "value": "83880e3dc1320831108871a3d11c1bdc6824f9254c2288484f1014f05c511d714ae8d8d4f8d97fc5660133d9a4796810", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082923, "uuid": "08c841e8-7bd5-4214-a105-aa677c1dfeec", "value": "F294232844BD4ABBEFF0361447D29B107A4FE65E26B37B7E94F25F5A870243905EA041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082923, "uuid": "b205d787-40e3-4f41-be80-cd2dc3160e74", "value": "12288:JTM89V6pYjPTOedAEfwoFcGLmfmAEmA7EyEA:JY8GctdOoFHjmA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082923, "uuid": "54b99bab-a81a-41c6-a51d-98b836f06585", "value": 435136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082923, "uuid": "912be0ea-02f1-4edb-a1bb-aa97e3f3161c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082923, "uuid": "197343cb-3b05-493d-9256-fc3d002b45c0", "value": "PO-0561.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1594aec-9151-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617106615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106615, "uuid": "204ffdf7-01e5-4f06-9e16-42440f4b2f7d", "comment": "Malware payload (AgentTesla)", "value": "1d6177218a6233299f8b96c116a51fb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106615, "uuid": "927503ab-f42f-4d00-9a97-8bdcec0e28f6", "comment": "Malware payload (AgentTesla)", "value": "8920369c3bb132f2d76d14cea36cd81e23aa1b7c844d2b9fae9fe9cdf7765dae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106615, "uuid": "2fa1f97b-974c-410d-8c13-fb431c9ce7b5", "comment": "Malware payload (AgentTesla)", "value": "1723619bd31fafc1e093566a454674ff1d3608d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106615, "uuid": "f89acd61-85cd-469f-86b5-7a25d53d5798", "comment": "Malware payload (AgentTesla)", "value": "33dcba4a6eafb4380f9b40be569db08a495eaeb2a29d3892250e4f5afc3b30c7659a8e03126eee09896c932e6e770d69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106615, "uuid": "aa6a41a2-3c7d-4d16-9d5b-6016d5358818", "value": "61C423966922D0CF5208FF6D33D95AD7786DEE32447F0894D1F8A5FE963FC0269A0A04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106615, "uuid": "cdb16550-34e7-48ed-900b-4899bfb144ef", "value": "12288:GK4M+mePEAzR8HZFk+G+4/NLZqFiPl7//4FEubBR+eORTjUC7:GKsmAEAzR8HI+qMFIl7//4F9bBR+XPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106615, "uuid": "a3a28188-9f70-4f13-a435-bfbf6999beef", "value": 582818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106615, "uuid": "7bf95b5a-b24b-45fc-b4c6-2c8867d7f0fd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106615, "uuid": "5b5e8d93-f261-42fb-9cb6-e5527e1303ad", "value": "NEWQUOTATION280321_RFQ_PRODUCTS_ENQUIRY_TRINITY_VIETNAM_CO.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3722936-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617088499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088499, "uuid": "7376a665-36eb-45f5-881f-f7630f972f43", "comment": "Malware payload (Dridex)", "value": "ca8abaaf2730af05d68892fda96d5abe", "object_relation": "md5", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088499, "uuid": "1b3eb5bd-6b1f-46a4-a83d-66eca19bf8d2", "comment": "Malware payload (Dridex)", "value": "89d29174e223d80b056e3f6b5c282b4dd07573cdf2014aec37d40e3f85d657f9", "object_relation": "sha256", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088499, "uuid": "633416ea-b297-4249-830b-f71d9297bbb2", "comment": "Malware payload (Dridex)", "value": "e17fb95a3ca471be1d75cf183f90c067ff5468ac", "object_relation": "sha1", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088499, "uuid": "789680e8-196c-4ba5-9e9d-2010e66a893e", "comment": "Malware payload (Dridex)", "value": "d245a48f64d0695fd3fc6efbbdf66611d069f0593c77cf1d69e9f56255fc4b18d5a5ec52ad02208517fd35ac6df709c7", "object_relation": "sha3-384", "Tag": [ { "name": "10444", "colour": "#327CDA", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088499, "uuid": "4aa9fbc1-b4f3-46f4-9af6-50e1100a3a55", "value": "22C4BF5397EA5421F6736F3908B316028AEBBEE1C938C4E861C4214D2B677D05B7C79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088499, "uuid": "d063de3a-adef-45dc-9a53-2cbe41cc0580", "value": "5cb457ca82de30b44453a66db17d2e56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088499, "uuid": "aebc6bd8-535b-43d1-b114-0040ffe5221e", "value": "6144:pGiMOQpsduhD3AZHC/uNbExd+4Quwn1b0717WLmw6Xg6DqaIDnnlvghc5la:0VhDQZHC/uNYu/nRm8LYQOQlY+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088499, "uuid": "0ad52164-baf7-486e-ba41-82c17806f729", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088499, "uuid": "a17ea709-937a-4bc9-898c-dc58ce962bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088499, "uuid": "6bdbd8b8-447d-4e3b-b35f-85eecf0eba0d", "value": "89d29174e223d80b056e3f6b5c282b4dd07573cdf2014aec37d40e3f85d657f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76734151-916b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117629, "uuid": "2bb3c484-3de4-424f-af86-ae51002a05b7", "comment": "Malware payload (IcedID)", "value": "96c632f7430eebd29e0cf761e08db082", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117629, "uuid": "ad7fa77b-c680-460a-9100-d201446450f7", "comment": "Malware payload (IcedID)", "value": "89d7241a1d35b156fe92a140774aec32ff3bdb1fbc1fcc80370da50f6fa0fd27", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117629, "uuid": "fda9627b-0ef9-4aff-bcdd-852abee34d6c", "comment": "Malware payload (IcedID)", "value": "d14f9246211f3577bc4cbf5c748ddcbf00ae528b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117629, "uuid": "5f1cd1d9-3a39-42a9-b408-35d89c7ad7ba", "comment": "Malware payload (IcedID)", "value": "5dd25e84c4ae38c2847585961fd2d13bb18151c6bc6ce7aac92bc74192931aa2219d7fa34bf2baa7669816ce232aca33", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117629, "uuid": "ba449356-1268-4d84-a06f-f63473f025e0", "value": "53B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117629, "uuid": "2a17c890-b4aa-4e87-8b61-13039d296534", "value": "3072:e2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:ezxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117629, "uuid": "0ac83ad3-5e65-42ff-96c4-6eeff0bf8a2f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117629, "uuid": "cc9bb377-b412-47aa-be33-fcefb42dd8be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117629, "uuid": "ce56a59a-2074-44b3-9460-aace3a20dbfa", "value": "document-1892098199.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0938122a-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115299, "uuid": "fc3a7b6b-a9cb-410a-bfc8-5cf5b5c585d8", "comment": "Malware payload (Dridex)", "value": "ff9be4d470657ca519033a26f5144560", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115299, "uuid": "1b5b8ae3-b849-4f33-ac27-e706de8441ad", "comment": "Malware payload (Dridex)", "value": "89e11becd91b3d2111391c7e0e36722e5243cb8763ecb4042ea5e2a3c31618ee", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115299, "uuid": "236a1747-298d-4bcf-8441-6e15b59f6ab2", "comment": "Malware payload (Dridex)", "value": "583f7e865b1902bc3a0294f86ce149b544a81f3f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115299, "uuid": "082fbed7-ccb1-414b-87de-fef334edb825", "comment": "Malware payload (Dridex)", "value": "c774db501da3ff4df6d50436f7b71f70f1271eb6976512175a753307853873bf191361b64fbcc115093b53c935f99b01", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115299, "uuid": "f6357365-49aa-487b-a24f-e24e870640d3", "value": "9914BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115299, "uuid": "963d8072-c79b-48c8-9011-f3b9ffcc37a4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115299, "uuid": "6a556daa-300c-43c2-8454-04b1963560b0", "value": "3072:J3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:hJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115299, "uuid": "7572663e-52cf-4802-bf71-b2c774c0fb6e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115299, "uuid": "2213f1ee-ea71-424a-a8f7-42c4dd33c2bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115299, "uuid": "86357dbb-5303-47f7-a772-7c755c540c6a", "value": "89e11becd91b3d2111391c7e0e36722e5243cb8763ecb4042ea5e2a3c31618ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3622cf-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127167, "uuid": "6a988d0f-3479-4785-b3d0-b19a4ffbc5d0", "comment": "Malware payload (IcedID)", "value": "9f3cc47a847221f900c77e6e278a710d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127167, "uuid": "e2033f40-7541-4a97-8445-97e1c0a022ac", "comment": "Malware payload (IcedID)", "value": "89e5e8b2255578fc6137e37092e2f2200f77e1ee873bb0659d7041e92e18c4a4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127167, "uuid": "f5283f9a-dc08-4810-a02e-e30493ee1bd3", "comment": "Malware payload (IcedID)", "value": "472afef9ef5fa84cd2b85b95495c114a966852ac", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127167, "uuid": "3a821068-7152-4592-bfeb-be09bf2b4e30", "comment": "Malware payload (IcedID)", "value": "020ec897cd8db3a5c8a5935972c250dd35dba8a4d15cb4090c3551eaa7508f5560e59673f665de80f054df8cd7d9708a", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127167, "uuid": "33ddf14e-dae4-40e7-9890-bf905a5e2498", "value": "63B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127167, "uuid": "df8582ef-6f0d-4a70-ad1a-478e89f0fd57", "value": "3072:k2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:kzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127167, "uuid": "76bed51d-5997-4b6b-aa67-0854ffd99102", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127167, "uuid": "1deaf904-fe89-45f4-9c0e-966e526e94ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127167, "uuid": "9f1820d2-268e-4d76-b861-49c1e0b3d7cb", "value": "document-273169119.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774b6b71-916b-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117631, "uuid": "dd27895a-c0ff-4c2a-8b5e-8614cbdacea8", "comment": "Malware payload (IcedID)", "value": "5e4323a243c7dc284bbc88f69e7946d9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117631, "uuid": "6ef3e05f-cc55-4f39-8acb-5a4dfbf19ba4", "comment": "Malware payload (IcedID)", "value": "8a0441ca8fbd3964cc7adae7dd0c02c08be1a843cc59215699de1307bff55f74", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117631, "uuid": "e99cccfd-5ea3-449d-9b3a-3d9b2b7180ec", "comment": "Malware payload (IcedID)", "value": "548317bd71379042f483a4ce8eff3916f165ff47", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117631, "uuid": "74fbe291-8155-411c-bdda-ebae22e86063", "comment": "Malware payload (IcedID)", "value": "76717f5f9e4364cbb7a42b06494ae27c31440eaaec9d88b20aea67c3e89295f9ec57c37b6fd9d31182f4eb55df5d3fbb", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117631, "uuid": "a70ea5d4-0cd4-49a4-92b9-55f58e45eaaf", "value": "FAB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117631, "uuid": "06a00fe3-323d-496f-aa2d-8597781e4e72", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117631, "uuid": "d3e3e9ec-1df5-4266-a629-6c69a2ddf9cb", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117631, "uuid": "e961041d-77b1-485a-b31c-f99b7d3b380e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117631, "uuid": "1fee454e-45df-41d0-97f4-d16e3a64080f", "value": "document-1545572638.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b171d4-917b-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617124331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124331, "uuid": "93e2aca3-0626-4d81-9d91-37a9bb4b1028", "comment": "Malware payload (Dridex)", "value": "3e1dce57cfbf9ddf7b746866c0de0cba", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124331, "uuid": "348d93e8-ebe7-491d-b153-3af353e7ae65", "comment": "Malware payload (Dridex)", "value": "8a13519d07b3d56866ee2e788c459186ea5b5b3945a29b6054addee0bb0576eb", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124331, "uuid": "47c7b9ca-a6ae-4b59-9a7d-eb15fd8ed1f2", "comment": "Malware payload (Dridex)", "value": "8d8050f071801185895dc83ee402c56665f38f2d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124331, "uuid": "716b5dd0-dbc7-4deb-83a6-be2460a5e292", "comment": "Malware payload (Dridex)", "value": "b1ba649eb5c9696ee3784ad7108ededea1db97367f17df5c9e01a3815a22c2750e1e2728b7c6e05d2c009de67ac1959d", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124331, "uuid": "f657cbfd-a1b4-4028-8c09-0f8a65686c4f", "value": "1D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124331, "uuid": "89b073b3-1bad-429f-adc4-a04941417078", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124331, "uuid": "477a4624-6bd2-49b2-a162-63761e4f698f", "value": "3072:43PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:8Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124331, "uuid": "5f3219d5-1a40-4eca-a66f-2b2192ec95a5", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124331, "uuid": "f5a96254-5bdc-4038-ab8f-1ca96b837813", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124331, "uuid": "82434b94-7010-42d3-957f-4bf696c735e7", "value": "8a13519d07b3d56866ee2e788c459186ea5b5b3945a29b6054addee0bb0576eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06b3d87-916f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617119472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119472, "uuid": "f5bc4a90-0db0-4035-9ebd-ddd47f1f7191", "comment": "Malware payload (IcedID)", "value": "e2b647f60e473cac4be150fd7cf39c1e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119472, "uuid": "ef316551-c6dd-4022-a7bd-a6648829f8db", "comment": "Malware payload (IcedID)", "value": "8a1d934aeb076df24c2ee37946652e6cb3e4cde52c0ca8578755fcc4ec0a46ad", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119472, "uuid": "8c91a289-4a71-41a9-963e-9f22f86752a4", "comment": "Malware payload (IcedID)", "value": "c798d6c36bff0968359bf63cfaf07988e813179a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119472, "uuid": "95ca51c0-8a2b-413b-a6b9-f33fd6b60c88", "comment": "Malware payload (IcedID)", "value": "232940ce963c3db20462bd96a3e76c3bfbc4e75e8f5092e635da55324547dfe411b012267e36e6bf1b0591c687397d3e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119472, "uuid": "d2241136-7d41-4664-8673-bb9f7351f974", "value": "B8B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119472, "uuid": "4672273a-d44b-4244-b289-9b2f4f9621be", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119472, "uuid": "7769906c-98b4-483e-a1de-8257b6e2bedd", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119472, "uuid": "c00d8f52-6e8e-46db-801b-15b14a98b7b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119472, "uuid": "4d3274c4-4d3f-4873-8d91-0a56b22f4dac", "value": "document-426957630.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad766c00-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617137479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137479, "uuid": "c6948627-70f3-46c4-b2a8-1bfc3282157f", "comment": "Malware payload (Formbook)", "value": "63ad3827b2f0b116f0264e9ccff054ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137479, "uuid": "88a6cae1-139d-4822-992a-035ee0e35a80", "comment": "Malware payload (Formbook)", "value": "8a79757beaf2ff4bf07fd6410a16358874d8e6725810c8141d47ff2365321a2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137479, "uuid": "ff1aaa50-c8ea-4ce5-805a-98f5331d1f4f", "comment": "Malware payload (Formbook)", "value": "22038206da2f7d4c8def058c3233513f5c47ee35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137479, "uuid": "649c85a7-5271-49cb-88f1-33fecad72a9c", "comment": "Malware payload (Formbook)", "value": "94ab6a186ca702cf0b76a8431352afe7c69c97d7830b13babeb9589af28498e09a1f49e06316413c4ed1874bed3a975d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137479, "uuid": "16b14748-bbaf-44a8-b255-1e0f9a8100d3", "value": "1B05ADAC3540B9DFC81BCD7689682C60AA60B1F7530BC607901B55ADAD0DE9FCF952E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137479, "uuid": "1d5822e6-89ea-46a3-8ace-d1d8619ceac6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137479, "uuid": "da70a21c-0f9b-442a-a3f6-c6c88bb17a6b", "value": "12288:j8lq6Yvqr+ZlvaojeATTi2aQ07AVuOltvusLnp9+R6gGeNcnk+++kPP/D1F+u9EG:jffvqypG2l07AVuuvpnL+RlHcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137479, "uuid": "78464d81-3851-4090-9f5a-71fbdc056046", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137479, "uuid": "10af89bc-8b3d-48cb-825d-58413a81035f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137479, "uuid": "6a4d3687-f626-4ee5-8311-b368dca34632", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8c8c3b-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617085617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085617, "uuid": "2f86290f-3a95-4522-a5d9-e5593cb15007", "comment": "Malware payload (Formbook)", "value": "46398b3bfed1b6e8944ddf8d15a34a02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085617, "uuid": "7af6abaf-e049-4e05-8276-aff18f3a29b8", "comment": "Malware payload (Formbook)", "value": "8ac1fc19367861f3a749d801300f554148e36a0e8a4f4cce3c5d3e4de43e4279", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085617, "uuid": "810c9468-f305-4921-b80c-1d6684fd3033", "comment": "Malware payload (Formbook)", "value": "5c8a0132528477da076ab24f1bf88bdb9f2faeb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085617, "uuid": "9ef65d92-dc2a-493d-9bc0-105fe711542e", "comment": "Malware payload (Formbook)", "value": "f005d23b2b1943b5bfe15f039c88ea90bb00ab9ae00165c406ef6f92f5644ca0e691d07667969a66f92b269e3f393371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085617, "uuid": "e1ec52a6-7097-46e2-ab31-7c126a06b00a", "value": "0E846A41B6B8C912C4350F30CBE2D6265E369F077A2277DFE26872493B72AB59B151CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085617, "uuid": "d7bc589f-f20d-4e42-9721-303226f6d2c1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085617, "uuid": "d715b693-b5d8-4167-ae3d-222914226bfd", "value": "6144:3APrvQziDrQUj/5sMuFX8TatK4QrQ0VaMCf5S0FDWZL4XIIfkYtI6c:gQ27/ufFMTZrTVTa4iytKIInI6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085617, "uuid": "ce4cce2b-a91d-4700-89aa-5e9b401fb8de", "value": 397825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085617, "uuid": "b7f7d25b-ce55-41c8-8f65-87ebf3c94eee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085617, "uuid": "a65dc75c-3c35-4cce-b4bf-5783a91b81a4", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a023bee9-9148-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617102667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102667, "uuid": "f5bbb686-6988-425c-89a2-e93264169c26", "comment": "Malware payload (Loki)", "value": "903dc72ca1b661e140ca405b1b3c4864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102667, "uuid": "42094dfc-1e34-438b-98c0-2e997266d1e2", "comment": "Malware payload (Loki)", "value": "8ac885cb586213ed3c0fb742d1c447653fad6de16dc436c6395099c759b403b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102667, "uuid": "17efa15e-eeda-43f5-abeb-58175f2e2579", "comment": "Malware payload (Loki)", "value": "bb6211538a93b553edaf9766edbf233f24f9a78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617102667, "uuid": "d904fb35-48e4-4fa8-85de-9cba1737870d", "comment": "Malware payload (Loki)", "value": "baf0ebc3b16d0c5b303e1b1c361bd4195228f41aa2c9f5278466f4b190d0613d2743dbe7c8b44af102688835aafa7c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102667, "uuid": "147165f0-238b-4366-94fc-7399f75105ad", "value": "AE84F171364BAC1DC99D07B901A382A0F376A6A675F2CB1FB09543553F0239F4B096AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102667, "uuid": "56077117-aea1-44d2-b590-8c8e9c70ed3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102667, "uuid": "b4c89d4f-f3b0-4a41-a377-fd7b1278c17b", "value": "6144:5wDoMPx7A5D0/6a/BFSxtCFBwD+hShLpwAElA7tQCUdBPsrHUCOtUhGt9lG:G0MSbMUtCknpwAE4UdVCOtUot9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617102667, "uuid": "dae7a0e2-dffd-4608-b743-846a6a4a7536", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617102667, "uuid": "36d7cafa-a6a6-411e-bfe0-5774f3c756da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617102667, "uuid": "1982647f-18c4-43c5-a667-08ebb9b58e3b", "value": "8AC885CB586213ED3C0FB742D1C447653FAD6DE16DC43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67dd653a-9180-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617126624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126624, "uuid": "2fe1f0b1-0a0f-4c78-b007-e54a95b76338", "comment": "Malware payload", "value": "0937815fa4b07374d68ba6e7644416e1", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126624, "uuid": "886cbe0b-9ee6-4e80-b989-756a0254b2d2", "comment": "Malware payload", "value": "8aed942baf1f581a31e9533622b6779a919de5efca0a72e817fefe88f5abc61f", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126624, "uuid": "c404445d-8985-4185-b5c7-1a5ef02a8d93", "comment": "Malware payload", "value": "880e1d91ae81a4e0414c307496b1ca9caa48c2f5", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126624, "uuid": "fc067f36-f84f-43c0-a3c9-6f31ebe4a7eb", "comment": "Malware payload", "value": "1565fa270868bf517b432f974939ac3ca68242a291e73759cced3fdc628d20427443cfc79df1367fe0cf3bf72e6ea75d", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126624, "uuid": "be521c93-8ae4-4040-b5d4-9ad1290fd0be", "value": "1CB3CF8DA294B41FC39FB43D6606A8E24D861046E943B13F35B47E0C25EE2D70F9E5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126624, "uuid": "16aacc90-da73-4e50-9e83-736d9e367c78", "value": "1536:ZLD6K/iTmK8V8HERg3wlNTc4Bx6oL4jSO4AzrFvJhTv7xVMsigZEQNggMorCKYfB:ZP1ClK8HEwToL4/TdV/vEQSlcC35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126624, "uuid": "69805046-d7c5-407b-bcfd-e5f782c6c246", "value": 116974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126624, "uuid": "b245cd62-cb7d-477b-9f0c-4dcc0289b6ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126624, "uuid": "1f8437a2-6ea9-44d0-ba18-efb6f4919855", "value": "fisc_101.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6408a2d7-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108579, "uuid": "5ec8a3e8-74b8-44b3-b7a4-ee40dfb15ce5", "comment": "Malware payload", "value": "8b7d5961255c419b6c6d7d628a23de51", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108579, "uuid": "7848fb25-93ac-40c3-bccb-05e72b1e8a1b", "comment": "Malware payload", "value": "8afb20ed34d0dbe73c1c4a8dd008ab13498d8c0702eaf5a23ede997f97df7ad7", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108579, "uuid": "ad7617cc-3de2-4337-9fb0-0b845a6e7a86", "comment": "Malware payload", "value": "48789023b83fcd5a65aef43e79fe5ca8d5163878", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108579, "uuid": "f44b7cd7-7cda-4d6b-a435-4d7b5cf74175", "comment": "Malware payload", "value": "5557f91608939a4b67b2ccff3938158ef73a334a4b30b891c97e6dd114f197240d6545c247b0f07d8953e9275adbb7a1", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108579, "uuid": "0f81ba2a-cbf3-4c00-86ae-cfd4fa98f558", "value": "6093127E613668AC51C29E241C3FF9542CE7F25E0207ADCE842D6550BD8DDA70E8ECE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108579, "uuid": "61bf4f63-ea18-442b-900b-fed838223155", "value": "1536:fEWkI09MQdA+bVlFMGlou3QVi9zLSYXyVk8TRf7khSJEzqhk/c0ch5ZptDPyGwB9:fEWkI02gLFMGxOi9zLSOyV1TB7qSaOh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108579, "uuid": "98c2ddd5-6b7d-44bd-b5c4-bf1acf99f781", "value": 91377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108579, "uuid": "ca6d1c90-081c-44dc-b4e9-25f26a793d7e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108579, "uuid": "a4fbcf2a-01fb-4088-89ac-479bcf30082f", "value": "impr_2679.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82e4c24-91a1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140959, "uuid": "a1527cd9-21c1-4739-aa37-b48bba3b0962", "comment": "Malware payload", "value": "308d84694d6d605ba27681110b1a2f5b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140959, "uuid": "923804d2-a7dc-4c93-929e-551a32e41f1d", "comment": "Malware payload", "value": "8ba73abf217981f9fcf7c298d6b62db7b58db7d362759efb0568e4778383bbdc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140959, "uuid": "2f5e2ee9-7453-48e2-a4b9-fda92c5f0559", "comment": "Malware payload", "value": "eec09e6792775a333a070d84abbe4f1a8721917c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140959, "uuid": "13df6782-3157-454c-9e19-d304a475067b", "comment": "Malware payload", "value": "31e811ee563af2ef5268f6938c8e278d4dc2aa47ef6405ded929ea37bb053df205f8e44cc73a0254bf6fa02fddc9a102", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140959, "uuid": "cbe997ee-1590-4c3d-a00e-8031b1f6f436", "value": "0C14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140959, "uuid": "c2464f3a-2708-4253-86ba-fb12153c8675", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140959, "uuid": "6cfb2669-e1d0-4c16-a6ad-ebeff664692d", "value": "3072:S3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:WJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140959, "uuid": "7b58d768-0f17-4cd0-96c4-1d4fe8aad6dd", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140959, "uuid": "d4d57817-a950-4ab4-82ce-204d6a80a61b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140959, "uuid": "f57825c5-4f01-46ac-ab67-b66a425ca97e", "value": "8ba73abf217981f9fcf7c298d6b62db7b58db7d362759efb0568e4778383bbdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddeecae-919f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617140137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140137, "uuid": "50dd7238-9d82-448c-99c8-992fcbe5eb6c", "comment": "Malware payload", "value": "80717933ef6b96c11132408c7dd986cf", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140137, "uuid": "13463fb7-ea82-4de5-9635-c15b788d9b4b", "comment": "Malware payload", "value": "8cb6baec652b6200557250f0c45d2da33e5d212f8346802adae22728c967dbc3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140137, "uuid": "a4bdab3a-7ed8-46da-9120-394059114d66", "comment": "Malware payload", "value": "c7dba91fc1c58f5ebc1ac0df618960170c1873c1", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617140137, "uuid": "2ac45f20-abb5-432b-821c-d416be0b9698", "comment": "Malware payload", "value": "8049676a045dd071cf551159af63f575f869cef881722824e44b370a46e39634af5bc762e74a628c9fbf627bb270e50b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140137, "uuid": "f926032a-3f72-4e59-ad6a-3a2f09cb581d", "value": "8D14AE9DD729E464FAF3D9F104359A1210BB6C48892F914AEAE0A5FFCC3FA5C01D124D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140137, "uuid": "be574699-37af-427a-8b40-649b2f3a70ab", "value": "756d47e140fb5764b6e625ca5c18a2db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140137, "uuid": "a2dab5e6-450e-49fc-a14b-ffb7b319e2a1", "value": "3072:Q1i1Z9G9EbbV/MHYA/yjVrtHjrxaeAphs+L0UzSzR10onPwiL6A:Mi78914FVrRrU3hsvPzRUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617140137, "uuid": "448cc31d-18af-4c0f-8bd8-3030e1c77a2b", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617140137, "uuid": "d7920ac5-64af-4e9a-872e-8ff613a5e446", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617140137, "uuid": "5f7def6f-cb12-42cb-b505-4b58f97225ed", "value": "8cb6baec652b6200557250f0c45d2da33e5d212f8346802adae22728c967dbc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b4b127-912a-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617089877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089877, "uuid": "3990428a-8874-40ad-a26a-16040581fa5f", "comment": "Malware payload (Formbook)", "value": "692bd89d8f8c658c6e2082c86e47dc2b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089877, "uuid": "26b11a2f-6dda-4f7c-92a1-29649c7ff905", "comment": "Malware payload (Formbook)", "value": "8d96cdba8c8ac7896773c03f0ab27a5cebe912d9cc6614fda1e149191fc6a7c7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089877, "uuid": "7ed4c737-b79b-4e82-b2cc-34773db6560e", "comment": "Malware payload (Formbook)", "value": "087abc5ead15c9ef40cbfb0dfd3a8aace808d77f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089877, "uuid": "d5155490-fca3-4578-b85a-8b9f94b66eeb", "comment": "Malware payload (Formbook)", "value": "c781556a1ebafbaa2b575796bae6e97a770d9008d5d87dc6f35fc4d72fb84fd4a02cc2ba75e8515ee14f4c7a625f2ff7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089877, "uuid": "135e89cc-11f1-4256-8add-863acdcf1c1d", "value": "9624121976E414BBC45785B10AB3CB73BAFFB7863222081727745EBD2A216C7CE03199", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089877, "uuid": "8ff7c4a9-7197-40e4-8459-07e40ff5b25b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089877, "uuid": "34c8d59a-90f8-4b92-b333-cc225137bbb4", "value": "6144:nAP7Kv8P17PFrEzLdSuT2ovUm3yyKu0n7RKXTjs6c:aKvwPJEzLdS4TvUi5t01Ojs6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617089877, "uuid": "180c0c06-d255-4db0-9cb8-4582ae73fc6a", "value": 230172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617089877, "uuid": "c9654347-81ba-4e15-a60e-df9eb13da043", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089877, "uuid": "13aca771-b979-416d-b12e-229c3c1733af", "value": "TSPO0001978-xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3213e65f-9129-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617089168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089168, "uuid": "2487871b-24df-4d7c-aa8d-699097f5a959", "comment": "Malware payload (Loki)", "value": "7fdaf9fb294240c95ac82fa160867080", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089168, "uuid": "ff6bc5d1-0de7-43d6-889b-b0cb9498aeb5", "comment": "Malware payload (Loki)", "value": "8da4517a1ad6dd83a12e6cec1ffd6ff30339357d345bbed8dc3295d6a7e0d2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089168, "uuid": "95938e83-f4b9-49da-9ef2-bfa75a4751bc", "comment": "Malware payload (Loki)", "value": "dad88c1208a0e0a578b7e1cd0097c2bb035d21c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617089168, "uuid": "14fb0454-3b64-41d4-adf8-f2a81bcf9bf4", "comment": "Malware payload (Loki)", "value": "449eb9aea46c01a66ee5d195f30161ad5bb4128a17f50f23d10640c7baf55409ef900ae2f6621ef0c44d4f3f787e17b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089168, "uuid": "cfe829a1-cfa8-4fff-a7c0-978328e3aa30", "value": "C5D49D22A6D0443BC16315785D17ABB96922FE223F58AA8B17FC7E0C9F383507D2C597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089168, "uuid": "c814cd32-6155-4477-b435-080957d9b781", "value": "1348df303efcafad50a6f5b8c3aa3e4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089168, "uuid": "6ab76b3b-d329-49f0-ad21-80e2acf2015c", "value": "12288:bsO+MZAkQfZuFvTdtchSOgA9PBb95pg+s9GgVO7Y:QRMdQfZuVTdafDZJODv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617089168, "uuid": "736abf03-c180-43a3-9581-78925a540a2f", "value": 632304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617089168, "uuid": "211608ab-f34c-4cea-b0cb-37ba71696dda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617089168, "uuid": "93c6ade5-0ef9-43e2-bef0-eeb087ff2a7f", "value": "Order30.3.22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a65ac43-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136427, "uuid": "218aec59-f9b3-44a8-838d-3a22e440b94c", "comment": "Malware payload", "value": "eee0a6f03e3d0fd64808adbbbebf079b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136427, "uuid": "fa5629bf-0e8c-45a5-8e49-adb58d9f811b", "comment": "Malware payload", "value": "8de0fe57b776b836a4cf6445821f49232c628196778c446bf4d19ce52f7b5041", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136427, "uuid": "a36aeaf6-b02a-46d8-b67a-91f089c20020", "comment": "Malware payload", "value": "85815c1a3dc42eeef27a69ffabd8ef080ccc762a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136427, "uuid": "de546f21-00ee-466a-86db-0dc0db51c722", "comment": "Malware payload", "value": "d323b2eddc01ec3ecd7ef4ca4d7c351836a217c1951e24969e972f2a4f2ef8cda3c90f5fe53a21f90d7f17b226d86fa4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136427, "uuid": "affef76a-f328-438b-a682-3aab8826253d", "value": "F414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136427, "uuid": "ef30ce19-4177-41f6-a866-6ebd17be6adb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136427, "uuid": "719c07a1-e2f2-4e57-a937-bdef00ba6367", "value": "3072:p3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:BJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136427, "uuid": "e898eb0d-bd3b-4407-a034-5b98a2e4269f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136427, "uuid": "c03e5db7-e2a5-4ad0-93f6-d2afac87578d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136427, "uuid": "3b50a82c-4734-4c5a-ab31-ff95bc746a88", "value": "8de0fe57b776b836a4cf6445821f49232c628196778c446bf4d19ce52f7b5041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db86223-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114474, "uuid": "0b7849d7-5fcf-4799-89db-28f95618b241", "comment": "Malware payload (Dridex)", "value": "a018bca4e8c771ba70e60543cd30291b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114474, "uuid": "eb7a329e-7401-4f26-88b7-4251f701547a", "comment": "Malware payload (Dridex)", "value": "8dee98c0f7027dbc0e32b339defae55456c317f6b0b99ea783edcc269459b216", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114474, "uuid": "db173f65-5780-4b41-9cc6-d957cead4ab7", "comment": "Malware payload (Dridex)", "value": "b3623ad5db8920ac559f2865ff5e6981cd021593", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114474, "uuid": "8806d8d1-336a-481f-9c5c-c1ee433d41d0", "comment": "Malware payload (Dridex)", "value": "bf311ea7523b6c96c8cf45e61821a1d6e5e5aa5bfb41e372248c83f1529363335d7f1fe489edeb43c4ca8e442ffb3517", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114474, "uuid": "74e2d95e-501d-4255-b811-30a9b1f203f4", "value": "2014BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114474, "uuid": "88ab2857-e195-4cf7-81a4-368b420f1ab4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114474, "uuid": "4286c6cb-a4db-41af-8d11-0d4dca5f0857", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114474, "uuid": "38d03b03-b64f-4bc8-bba5-3a4479a3e72f", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114474, "uuid": "523bc023-f80a-4438-aaa0-15c13c9dfd3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114474, "uuid": "fa420e8c-672d-4a39-89d8-918b3144aff4", "value": "8dee98c0f7027dbc0e32b339defae55456c317f6b0b99ea783edcc269459b216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ceddda1-9127-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617088408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088408, "uuid": "56cb7636-1feb-485f-9872-93c42d6d4c08", "comment": "Malware payload (Loki)", "value": "f7fc9eebdb11dae6a577cd86ebe8e51c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088408, "uuid": "3a1f284a-f655-4323-85aa-6d8c808f0cba", "comment": "Malware payload (Loki)", "value": "8e15f76149baa634caba6bcb021a5793f9b86c6290247d62a3f9628e5e147c7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088408, "uuid": "ffe74657-cc86-41ba-aeba-f93df50da038", "comment": "Malware payload (Loki)", "value": "3ccba9324cdb7a4f980a407851d0c29eebab61a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088408, "uuid": "eb487fdb-2bd3-4d09-bf17-b595b15c09d4", "comment": "Malware payload (Loki)", "value": "c3fd2c881b52113590f3d8786fd19254eaa10a1b6d5783d9a2d595bec825f1adc5e65d66ca307a48cd223eb6e4953ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088408, "uuid": "d3764da3-d334-4235-9945-9fa8107dab7b", "value": "87A3B4F47E5435F7C79CFA369C8D77416CA9A1F32802865B588780E7F8326A718D812B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088408, "uuid": "d13f749e-2d3f-48a1-9b11-4b7455f5c4c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088408, "uuid": "9aff61c9-c65a-4c30-ade5-6fbf4e596a5a", "value": "1536:tnf7knbvlR7mdvxlbszlpeUW7w6k55C2/T9LlDsJJH:tnfYnzP70xldUxp//DQJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088408, "uuid": "1f2b4091-f2bf-4321-af15-a87a03f6f570", "value": 100968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088408, "uuid": "8636be39-1206-4dc7-b06e-82cc0df9e0f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088408, "uuid": "c268ea22-b8fc-4c46-aae1-9a22052ee701", "value": "f7fc9eebdb11dae6a577cd86ebe8e51c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce07a58d-9183-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617128084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128084, "uuid": "449b8b96-018c-4f9e-b23c-87a4b00b84ec", "comment": "Malware payload (IcedID)", "value": "844776cea74701ea3af48da101946dfb", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128084, "uuid": "cdb74488-a909-4fbc-b97c-d74a4cc55147", "comment": "Malware payload (IcedID)", "value": "8e3732e960efab59f5c8fe2dd27de0ad71881af2ab237d888cb7a5e0c232c169", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128084, "uuid": "5444959c-4965-4844-abf6-1e54c91980c7", "comment": "Malware payload (IcedID)", "value": "3dc54264d7bd392b3970126cfada7fe288ba224f", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617128084, "uuid": "3b223a65-6769-4e47-9d65-221a7f37d288", "comment": "Malware payload (IcedID)", "value": "4986d4dfdfcffb1b3d696c4febb2203d55817ac24eb2212d2398800561fdc81fc6313eeca27e0bb540675832adc67739", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128084, "uuid": "a1c78247-f8a3-47aa-9f70-c43afa4942ce", "value": "A1B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128084, "uuid": "f6aab045-1aa6-442f-a05b-1121f69a07ad", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617128084, "uuid": "2d669a92-44a0-4f37-ac8c-acaa9baa8202", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617128084, "uuid": "6799cc55-f6b1-446d-b012-2876846134d9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617128084, "uuid": "b8f6282e-4071-4e31-86f2-6c35508fbb66", "value": "document-833042675.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78960b16-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085421, "uuid": "491113f9-569f-4613-b4eb-dcfa29a4b0f1", "comment": "Malware payload (AgentTesla)", "value": "2dea92e5234e56d5445ef16922eb8df6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085421, "uuid": "f8be84f0-5735-4f2c-9e35-a2a5d4664635", "comment": "Malware payload (AgentTesla)", "value": "8e570c209cf850474efffca94eb1c96bdb3acb819683aedd4fe7f9877e537881", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085421, "uuid": "d2d55c64-59d5-4cf9-88f1-f6ae8828150c", "comment": "Malware payload (AgentTesla)", "value": "c1a5e45de53504fac8210aa7f73b9a11ce44db66", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085421, "uuid": "5174a51f-c254-4b3d-a785-cacc24372ef1", "comment": "Malware payload (AgentTesla)", "value": "fb7c1ef7f50d2345e6984240f760981b1b3b3c888d1a4c35277a402ca87c387cdfe40eecbb46a2b81ae46236d44d40b7", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085421, "uuid": "7ca355df-3556-4070-bb41-cad607f97679", "value": "FDC4235CE07B22D77FCBA676D8CD242208F5314C2A3EEEC3DA4174EDE6896652E57108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085421, "uuid": "1a9c9779-a75f-4d52-bd52-6bcee14ec4d2", "value": "12288:xdTZgyxyE2OWd8LuX9vhJ+A7OR5REKTJ10TL58HYeQ:xdTZp08iXrJ+AyR3ELRY2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085421, "uuid": "34a725c9-6572-4364-809e-0c36ea895f6e", "value": 589636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085421, "uuid": "6ed8537f-20c7-4489-8c99-049fd9036bbf", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085421, "uuid": "463281b2-a990-48f1-a3b9-1c49b0a02f18", "value": "OUTSTANDING PAYMENT,PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f582877d-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121279, "uuid": "c926de88-ad6e-419d-8342-b8701f32811b", "comment": "Malware payload (IcedID)", "value": "bf30da617d9c04dc4fc15c5fe3439b55", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121279, "uuid": "2d786a9f-b7de-47ac-bc18-2d1b339c6668", "comment": "Malware payload (IcedID)", "value": "8ea7de1bb349f457a421bbb93ef7f35b2a9af59e2581bc952cfed19816729bbe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121279, "uuid": "041f7e68-9c65-4cb0-8d13-911c2baa9a22", "comment": "Malware payload (IcedID)", "value": "8d13984b1ee1bd09618b3fd487bec311f70116f8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121279, "uuid": "966b0d19-e51b-4847-8e9e-948a80cb1662", "comment": "Malware payload (IcedID)", "value": "931cf3758b9c346a8b3a91649d3737ad9bd764be0d5a26b827ec0da649c12677121bea0aa33e85db82e5b64aba7e47aa", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121279, "uuid": "37c9adb6-95ed-419f-ba3c-a8d97fdcfb45", "value": "C2B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121279, "uuid": "8ff8441e-8aa9-45ac-bd7e-14e66f713a6b", "value": "3072:02CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:0zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121279, "uuid": "8cdab1ed-0635-469b-a8cb-07ceba8cc1bc", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121279, "uuid": "d645d500-838e-4c3d-a818-6db442fde411", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121279, "uuid": "aaa489bf-2e0b-4e11-aeae-4839b8e8814a", "value": "document-1175316779.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfeb0cc-9190-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617133505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133505, "uuid": "b8759cb7-58e3-4063-8481-4629a64f52fe", "comment": "Malware payload (RedLineStealer)", "value": "9b85fdae969895177a9c43bb754b4380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133505, "uuid": "0aef7d47-231b-470b-88e6-c54cf89e3ed2", "comment": "Malware payload (RedLineStealer)", "value": "8ee3f8552ada957d8ef80c2404e5886759f8aa075c1452b8abfe0b9e2d14285b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133505, "uuid": "e3982535-cc3d-4198-8606-17c1f54eeabf", "comment": "Malware payload (RedLineStealer)", "value": "c7ddc49a2948c6255c2aa87532bba9ff4c75cd3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133505, "uuid": "479acabf-c731-431b-a9ce-b9c0272ca5f3", "comment": "Malware payload (RedLineStealer)", "value": "1bf8a7d166f3c08f008180588048b557cb3aa61dac14d571686da27ce3fad9677addb63f3ab0dffa3865feb2b449a34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133505, "uuid": "46feebce-7bb1-4fd4-b654-012494a33981", "value": "2A358D1977E58B3DE4BE2BB5B075664013B0E146A60FEB174EC9A4E82DB37A001273D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133505, "uuid": "1aa4d63c-bbd4-43db-a5aa-7e49677110e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133505, "uuid": "d6fe5718-3628-43b9-a49e-5dba8f7d1c77", "value": "1536:azGb9xCsRBFHrmHrD2FAtxpn0zuQrPDVFL:WGB78DEEh0zPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133505, "uuid": "8378d378-fb77-4813-b9ca-059fc33dc5ea", "value": 1071679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133505, "uuid": "cd369d83-e4b4-45e8-b97d-d706998fd0eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133505, "uuid": "19dc3391-dd2d-478d-a5f3-db86f088beda", "value": "9B85FDAE969895177A9C43BB754B4380.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffdc4111-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115283, "uuid": "e9204fef-2622-4dd4-9727-4878da159c0d", "comment": "Malware payload (Dridex)", "value": "b0e8c1278d12b9dd38bdab9f7cc10a14", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115283, "uuid": "01ec23b1-4ead-429b-89e8-121d07a6daae", "comment": "Malware payload (Dridex)", "value": "8f0b2d84ab75ce1797f0b973f8bdb7d7f8868d7d758dbbb936c3f147fa0288fd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115283, "uuid": "6bfa521d-d346-4261-a129-51f71947bcaa", "comment": "Malware payload (Dridex)", "value": "9945dd60abf0ba992e2cc911e31cc830f894fa95", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115283, "uuid": "9a8a0dda-58b1-40d5-9c87-8c8b571db06e", "comment": "Malware payload (Dridex)", "value": "d1d64c347216613d281e8ecdc0a1c0e6d21b66f23fe9bbf7ec1469f2ace144a16a12315a4f3ea78922e6c1e9ad1a008b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115283, "uuid": "d78bc9d1-ceca-4c42-bb8d-2602ff703d44", "value": "0414BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115283, "uuid": "955c5402-e50c-4637-a393-fd8ea64d85fd", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115283, "uuid": "63e0fc8f-923f-4d23-8579-1eb9e3f36e5e", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115283, "uuid": "54842a32-77af-41ea-a8ec-47f04d5a9cbe", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115283, "uuid": "19dd42c1-56e2-4ee3-b4e2-12b2db471ba9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115283, "uuid": "95a06774-1bb6-4d94-a542-dd093e48a25e", "value": "8f0b2d84ab75ce1797f0b973f8bdb7d7f8868d7d758dbbb936c3f147fa0288fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691b3d95-9187-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129633, "uuid": "bed6fa13-25e5-4e21-aa73-4d6a7d71a58e", "comment": "Malware payload", "value": "8fd43d4bf147d583db6cb62ab7f71c18", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129633, "uuid": "9fbb4fd8-ee80-4b21-9625-3df4b1b818db", "comment": "Malware payload", "value": "8f4f1248d5a6fa1c05d8ab01329788ccccc31a6b662a33d917584ab4969d54cd", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129633, "uuid": "067b5079-70f8-4772-b6d8-2756e5b9af52", "comment": "Malware payload", "value": "24b30608ca09d8feacf4ea7c755374905eafd1fe", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129633, "uuid": "c46104eb-c6a0-4721-9379-583ab9d78592", "comment": "Malware payload", "value": "edf46c078d9a86641c485f812d666cfce12f8d28affca06e2503e5c81699c9d9432f95524a6b576a667c586bdbf35439", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129633, "uuid": "3d55c864-bdfe-4ef4-be9c-715d15179f76", "value": "3A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129633, "uuid": "da5bd353-e780-42e6-bd63-be50c0cbf635", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129633, "uuid": "4f2609d8-8727-4a28-bffb-dd6b29c047c8", "value": "3072:k3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:AJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129633, "uuid": "dbe376ae-5491-42d2-84e7-17e84734699e", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129633, "uuid": "e90ffbc8-9f78-4cee-9469-c5c33c93ec35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129633, "uuid": "a625cd3b-8fc1-4cc2-bec9-ef6ad892f014", "value": "8f4f1248d5a6fa1c05d8ab01329788ccccc31a6b662a33d917584ab4969d54cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59d2a58-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "8fc319b4-2d04-4617-a733-1767bc6ea78d", "comment": "Malware payload (Dridex)", "value": "1161a43dfecd6d57f2ce79956e1935c8", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "7149112f-8e70-46a7-acda-16a6248f0c21", "comment": "Malware payload (Dridex)", "value": "8f702e7cd34ebc980d8491c5601e860b76b7b290f2c3d5862f24289eedc1b514", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "78e67b58-61be-499a-aa4e-cda02d7f5b91", "comment": "Malware payload (Dridex)", "value": "c38ff02e52114badf90bc7317658bd5a027b4d71", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115266, "uuid": "2b39ff37-8ea8-4e2c-92c1-e88b66ddc373", "comment": "Malware payload (Dridex)", "value": "d7d668853c9e418ff25a153089dcd96fa0ac22a5d4080c3e4dc3810d35bd0cebb3036b8f08e5be49a47dc99d1a5505e4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "0cb5de9d-a84d-4741-a2eb-71fae672270f", "value": "1614BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "fad3975c-d54d-457a-b46e-f7db88f578b9", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "0a23e7ae-7038-4583-bde3-f5a57ef9a6dd", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115266, "uuid": "a0384bee-eb21-49d6-a00c-a25fb1118fff", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115266, "uuid": "a2609a21-7ded-43a4-824e-99994188d220", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115266, "uuid": "567bbe1e-7f87-4376-aefe-76c10ed57f93", "value": "8f702e7cd34ebc980d8491c5601e860b76b7b290f2c3d5862f24289eedc1b514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723c83f9-917f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617126212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126212, "uuid": "d9e3303d-4864-4aca-ab79-7bd6a1e99639", "comment": "Malware payload (IcedID)", "value": "0b426ae5eebf639b9a87329487686781", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126212, "uuid": "520def10-ebe0-4985-aee2-1ca44cbfae41", "comment": "Malware payload (IcedID)", "value": "8fb5502073766ce2b6b2b052a698c6a42346d36cf51de7a669b244cf4f6c55af", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126212, "uuid": "95a08982-07d5-4eec-a5be-dbc1ef861b7d", "comment": "Malware payload (IcedID)", "value": "fa0ba1c25c2bfbefd689e1bba1fea6612bce543c", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617126212, "uuid": "5ac61542-836b-47eb-82e1-d71825c4e8e3", "comment": "Malware payload (IcedID)", "value": "42eefac4a3da863a2497cb851d9cae3cbb13d393d9d721de27d9a6334cc5420ae6f467fd80d98f096053a3ca0ee632ac", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126212, "uuid": "0da38e92-39ce-4ef2-bd65-62d256a90cbf", "value": "B9B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126212, "uuid": "5c8eb966-4c69-4139-87f5-46c06d45076e", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617126212, "uuid": "94a390cf-f639-495c-9e2e-c449413df15d", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617126212, "uuid": "05a3b6e1-1df5-4861-883d-e26a0c314d3e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617126212, "uuid": "e11626f3-b132-4fd5-a1f7-626cab1a5960", "value": "document-1147757.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4f5d01-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617120889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120889, "uuid": "471df54c-f3be-45a0-a9e1-4ce9f3018df9", "comment": "Malware payload", "value": "a64f9b8e2ae530630238c32a62154cc3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120889, "uuid": "07ecbc19-c40c-4934-8031-ee94a28c3e7c", "comment": "Malware payload", "value": "8fd5aa2a0d5bc3b7831bc81ee4620b464931123050df49ecfbd1e18c16f5bac5", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120889, "uuid": "a3a07aac-1c0e-41a8-80f4-6f3bc00423f7", "comment": "Malware payload", "value": "052d9e246cffff268ef706bc0d1f6a996851b1c3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120889, "uuid": "d426dab6-7928-4ddd-b9e6-04399de90cf5", "comment": "Malware payload", "value": "a5fd6ab1551ba62ac626ccba6abe11f257cfe407a07bb3f1d5f8f41230f7c0d5a90f6e5b0c8ea3eebcf71a441c48387f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120889, "uuid": "ecc62ede-1f53-4ada-a34d-e40498c8a98b", "value": "A714BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120889, "uuid": "415ebca2-319d-428a-8d9b-94b58817057b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120889, "uuid": "2e67132a-ace2-41d7-bdd9-7b844911ea34", "value": "3072:/3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:3Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120889, "uuid": "3fe72b7a-25cd-434a-8fa9-a3633f0183ba", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120889, "uuid": "bf9d55df-406b-41cb-8269-f6f67cd9588c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120889, "uuid": "3c965933-71d5-495a-8318-6702b87b816b", "value": "8fd5aa2a0d5bc3b7831bc81ee4620b464931123050df49ecfbd1e18c16f5bac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0726dec3-9192-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617134193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134193, "uuid": "868cd5a7-b1b1-4421-9e6b-737222cb4760", "comment": "Malware payload", "value": "615a793628e406a508d8aea7fcfee9e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134193, "uuid": "8fa16e53-85d0-409e-99c6-292cd910f086", "comment": "Malware payload", "value": "8fef0254b0b69bf44138b65805b0f6f39e0cf3a4f04dfd930e777a0d557ddf35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134193, "uuid": "bbd366f3-f971-4a41-a2d7-100f94d92268", "comment": "Malware payload", "value": "586d9b122b5bdfb159a840b3d9901002cf737c68", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617134193, "uuid": "118823c7-2272-4562-a496-d8c2984f119c", "comment": "Malware payload", "value": "821eff96d0c6dca7ba00638255c84f38fb985179d21dce68dc561d93314aff15bdfeda335896fc30619901f7f1d25c5d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134193, "uuid": "87d9f24d-1b75-40bb-b8f8-4b811b1c967f", "value": "C6B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134193, "uuid": "e602865e-7578-4a90-8c00-d7f9f6a5bfa5", "value": "3072:A2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:AzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617134193, "uuid": "6ff5c290-ca60-42c2-9256-f80d18e934a6", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617134193, "uuid": "eb8f3e1f-9b60-4571-9ea3-4f2d06cf5207", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617134193, "uuid": "b93d3e5e-0775-4cc6-8ed0-49b9fd97d80c", "value": "document-1476911435.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c289073f-916a-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617117328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117328, "uuid": "e1aff7e5-b8be-4655-8bb8-0ed5b57b2380", "comment": "Malware payload (IcedID)", "value": "656709c4a3d09b7aa110ce2eab74c749", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117328, "uuid": "523a46e6-e0a3-47fd-92f1-99aeda7eae47", "comment": "Malware payload (IcedID)", "value": "903724a0bb1863dbdf2ba42540de1987a715ea3dbc4780fd0c47c7674a000a04", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117328, "uuid": "862b26d5-c8c1-4556-a422-93623137e55e", "comment": "Malware payload (IcedID)", "value": "edb21b2d9f95be9f728c29023a4905768eef78ef", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617117328, "uuid": "3621fcbe-afcd-47be-93c2-fe78db3ab580", "comment": "Malware payload (IcedID)", "value": "fffbb7e35558666261375d784508f8ffa52c985a31410aaee973bfe81c278c5f6eb2199d4f56d5d462ee6e6ac36b51dc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117328, "uuid": "44030583-2287-4741-8b29-47416c32b27c", "value": "BBB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117328, "uuid": "871300c1-dacb-4bc3-b0f0-dc8f4cd1bc51", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617117328, "uuid": "012c6aa2-988c-4ec2-81d1-63891e797285", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617117328, "uuid": "e1d884d8-0897-46da-82cf-80cd8c781fa7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617117328, "uuid": "a32955dc-3e17-4436-919c-96be4b7feb33", "value": "document-1078127495.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b6f9d7-9122-11eb-abe1-42010a9c0039", "comment": "Malware payload (RedLineStealer)", "timestamp": 1617086163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086163, "uuid": "d51536ce-06c3-4317-ae98-67af374ae03c", "comment": "Malware payload (RedLineStealer)", "value": "fe6f0b5909b5dc758839ffb73c5b8a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086163, "uuid": "d1ed67ed-654f-48a3-8a8b-7b5307b08b1d", "comment": "Malware payload (RedLineStealer)", "value": "904060b08b3803d996c3fea19929c6279e12a52e336596fea3fcec5f3e3d18d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086163, "uuid": "bc510909-1e55-4272-800a-db61c807870a", "comment": "Malware payload (RedLineStealer)", "value": "4a0a50e847ec4afe72e78b12ad2b4166502328d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617086163, "uuid": "4293b0b3-5c10-4a26-858b-34d4c1d7c74b", "comment": "Malware payload (RedLineStealer)", "value": "f6a024649f19f7368684d3dc3f4f4bdba17e10cb5c36aca376f8e3ea81f8b2ec63610c95358a4f63ac0d599d373e8ae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086163, "uuid": "adbb6c01-cbe6-4d60-b5cd-256f03f221a0", "value": "8224BE2071C0C1B3C4B7113144EACB759A7A7471077A96D7BADD2BBA6E213E1A3362CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086163, "uuid": "78954618-466d-473c-a335-426e736bf9d0", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086163, "uuid": "62e33c51-1b79-42f7-9311-8bfd911efaaf", "value": "3072:GDKW1LgppLRHMY0TBfJvjcTp5XfZsMqAyfB9fARVamHn:GDKW1Lgbdl0TBBvjc/fZ5qvubX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617086163, "uuid": "dc1b9de9-1eeb-41a8-8571-efb9143707bb", "value": 210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617086163, "uuid": "0a63d062-58b1-437f-b8eb-095672128438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617086163, "uuid": "3cacde3b-afb1-4537-8cda-47b4b8404432", "value": "FE6F0B5909B5DC758839FFB73C5B8A8A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ebd15d-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121580, "uuid": "d8c02355-37cf-40f1-93b3-ea62a2a49a81", "comment": "Malware payload (IcedID)", "value": "208f9e3fecc0111f6c7e6700effdfc84", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121580, "uuid": "3879c52f-8748-44ff-b8c3-ae50c7fbfaa9", "comment": "Malware payload (IcedID)", "value": "904692fb87366277348017faa9987736f69d8cce5e8656a39b582101e76ec480", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121580, "uuid": "dffab6b1-2c55-4854-a3d7-0a96b2a8041d", "comment": "Malware payload (IcedID)", "value": "dbec02aeb55c381807235f5cf4e13bb36db9813e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121580, "uuid": "4c9026d3-39fc-4a67-b0e9-6cbc723a4536", "comment": "Malware payload (IcedID)", "value": "b37f685e107d3a8c7dadc7d8543bb5813ce8a72d03cf421df9106b72fee323792e378a3c77ba152ea5d0ccfcf4f7bac4", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121580, "uuid": "885a0d0b-0bc2-4379-a93b-772f32ab2328", "value": "30B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121580, "uuid": "0a6e0d92-3912-4f93-81ee-159f53a5d842", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121580, "uuid": "e656a5c4-5106-4fb7-ad29-4ec200905fa0", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121580, "uuid": "1b36ca12-fba4-4db2-8d6f-99236e1f736d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121580, "uuid": "9ec50b16-2e55-43a4-828a-4092b5d5becb", "value": "document-1067949167.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c62e403-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131705, "uuid": "194cc02e-8e86-4b25-b5fb-8d766ed9a711", "comment": "Malware payload", "value": "2fcf7767bad4f36cfdfbaaf8c01f7972", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131705, "uuid": "eb0601d7-d433-46f7-aff0-765d7656d406", "comment": "Malware payload", "value": "9156c7996928e39c9cefb8107baecf4f34fcfe58440c137b950439c8d36f7338", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131705, "uuid": "302ab57d-5fdd-4e88-9567-12009a24c9bb", "comment": "Malware payload", "value": "dafbd0fbba51380749d83362123efd2c8813673f", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131705, "uuid": "a07d4285-e920-4148-b67d-491ffdce131d", "comment": "Malware payload", "value": "cf62b937606450d95638a2fa418ae38e6da2bc4af29fb7b122010073473ac8e580635a9b5978427592125543c086f3b7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131705, "uuid": "e2dfd641-879d-4ea2-8538-5f48ff513cd5", "value": "6914BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131705, "uuid": "5fe900a3-15d3-46b9-8939-08e483c4c7d4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131705, "uuid": "7ebab245-bfc6-4ce8-a010-20a032540879", "value": "3072:f3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:XJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131705, "uuid": "673e14aa-b9b4-427b-9128-e1e01be53b7d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131705, "uuid": "c4819849-9d7f-4789-9801-54ad384948bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131705, "uuid": "db5ac31e-89f2-4fdf-b046-09d7ceb9da6a", "value": "9156c7996928e39c9cefb8107baecf4f34fcfe58440c137b950439c8d36f7338", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2cfdb0-9190-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617133395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133395, "uuid": "8236cb31-e125-4bdf-ae2a-6763b048a054", "comment": "Malware payload", "value": "6563d7f2794c6f63ee1725bc5fa11022", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133395, "uuid": "28a4b560-9fcb-4cb2-ae2a-1c95188a7ad1", "comment": "Malware payload", "value": "916fa4db77e393c7a8972ac92d2ec6bc4f76bfaaff742f96da8c9e5da304a26d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133395, "uuid": "6bfdf349-b72c-4ff8-98d5-eb68eaee5d54", "comment": "Malware payload", "value": "3e45487b934c1fb7abe72f5fa74614c23f4bfd1a", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133395, "uuid": "2a5b4e8b-146a-43fa-b08d-8eabd1813ab9", "comment": "Malware payload", "value": "aa0fb5a4e295d14970f1eecb02635f765f76abf59e2d7f4b085ed3d497b96c1bb21864275b1de67d3fdad9c409b9cd28", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133395, "uuid": "7e0607d2-1c58-496c-9025-931d264f5bfb", "value": "5B14BE2DE333D495FFF7CAF41492AA2A8A7B2D40821F6A18B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133395, "uuid": "1391dfad-bc2f-4a41-8ff7-447ba752ba12", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133395, "uuid": "e0ca78c1-5afe-4916-afc1-1eea33b8ba6b", "value": "3072:O3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:qJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133395, "uuid": "0bfe3016-938b-4821-915f-665bb2851a78", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133395, "uuid": "dd51499d-e843-4d32-b640-369eade2e9d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133395, "uuid": "9409cafd-b351-46aa-8fba-996913b647a0", "value": "916fa4db77e393c7a8972ac92d2ec6bc4f76bfaaff742f96da8c9e5da304a26d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d43a55-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131607, "uuid": "1bdc9c0a-ef86-4960-b490-fd033dd1f409", "comment": "Malware payload", "value": "47d1e96a9d65bb967f721ee42a3008dd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131607, "uuid": "a0cf4cbd-044f-4fd1-878a-8973168e9623", "comment": "Malware payload", "value": "921d8c3dca6ad41e20aec19e54167f8d7b1d9a98b985029c3afd2bf718d0f674", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131607, "uuid": "84ac2c55-365b-49da-a154-828994330fa6", "comment": "Malware payload", "value": "a113fa6b23eb6f2eb034d65d98ca17c13769deba", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131607, "uuid": "3abb3a2b-c34e-4d53-805b-60e445fed92f", "comment": "Malware payload", "value": "a0c8231d0075edbe67e88f30e70b1022fd18e88fc7f39220747080c36be2aef024eb8b013d5a038e431ba0f39c335345", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131607, "uuid": "3c16a395-0abf-440f-b290-5268a52cc342", "value": "DE14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131607, "uuid": "986ad4a7-3645-4794-b30e-b3c5e01833a4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131607, "uuid": "20c013c6-7ea4-46cf-a8d4-b90b821ae840", "value": "3072:F3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:FJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131607, "uuid": "598bb10e-775d-45e1-ac17-9155112bb08a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131607, "uuid": "6501d7b4-d7c6-442b-8d1a-e88a463bc865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131607, "uuid": "f110d727-03f5-431d-8520-f377d5efb391", "value": "921d8c3dca6ad41e20aec19e54167f8d7b1d9a98b985029c3afd2bf718d0f674", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad22b170-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121587, "uuid": "df37f6e0-92e5-42c6-a6a6-297fbbc55019", "comment": "Malware payload (IcedID)", "value": "97c9e9d79e3ca0bc41ade89b208fd672", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121587, "uuid": "3508f228-805f-476c-8997-9c5b24aa1088", "comment": "Malware payload (IcedID)", "value": "92494f295eb3936e5df57a06d9ad9750e50e9d8a0cd1500449ac33a78bcb499c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121587, "uuid": "78ece1ad-3c6a-416d-8041-11dcfae3b119", "comment": "Malware payload (IcedID)", "value": "3cd4387d5151d6cc3ad50dba849195ca61cc5260", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121587, "uuid": "55ec44c1-a784-487d-b23b-daa44fe4f6dc", "comment": "Malware payload (IcedID)", "value": "f56d8ea57ab342b3b91b243aa3b664a45a84cbc066ce3d8faa00424b4fb446f018d759c49c269429ecbac619a8885e01", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121587, "uuid": "43891148-9109-4c20-916b-54439d2eb424", "value": "7DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121587, "uuid": "f53c86ef-0337-4a4c-bff7-c06614671e26", "value": "3072:u2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:uzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121587, "uuid": "cacd0f31-dc97-4250-845a-f8b435619999", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121587, "uuid": "39bf459b-bb04-4fc0-a15e-42eac0900e8c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121587, "uuid": "e09d0c1c-1529-4560-a4fc-f38a33defc26", "value": "document-1599569440.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c60925b-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617114096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114096, "uuid": "9a2eea15-2cf0-4f1b-be27-e75114ff64e4", "comment": "Malware payload", "value": "fe365ef7eaa0ae6c00b6737b8745e891", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114096, "uuid": "21e05a17-b9e2-44cc-93f9-8ddf71486735", "comment": "Malware payload", "value": "927f819ab73b932603bba61c3fcecfa02e2076c8e07227a590882e7295a4a154", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114096, "uuid": "c2d4281d-8cd2-4ee7-8bc3-b83c82a1749a", "comment": "Malware payload", "value": "ef43efb78ddb50b3b3fba37337c4e3c40c10d0b7", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114096, "uuid": "fb66c05e-f013-4800-86b7-e3bbb75bfb97", "comment": "Malware payload", "value": "c179f916b98b390a51171462dccbd1c6b1539ebd8c99038a1c6eb9f5c2d2b5646893168106c4a6a00270af7c7a58b559", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114096, "uuid": "5a1dcfc4-3ed3-476b-9dc4-9a167dae9e0b", "value": "7B14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114096, "uuid": "6bedb01b-9899-49ef-93d3-49af60b3d5d5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114096, "uuid": "8bd6c822-c53c-4651-a0a8-6ec0805d783e", "value": "3072:a3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:eJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114096, "uuid": "e117211d-db9a-463f-bfa0-da0aea8f2dde", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114096, "uuid": "1d6cc99c-1bdc-4d48-92f4-41c7edd93bce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114096, "uuid": "3386b1c5-b692-4450-8854-046adbb9488f", "value": "927f819ab73b932603bba61c3fcecfa02e2076c8e07227a590882e7295a4a154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06147b5c-91a9-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617144070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144070, "uuid": "65e9e74a-3d5b-41b6-b59c-8a8f8360591e", "comment": "Malware payload", "value": "f7d0490efa9a312999feb75c357020bb", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144070, "uuid": "79cbb5bc-6044-43b5-b805-05aa7160f627", "comment": "Malware payload", "value": "92b77df5bda7db565e90e6dd93c86361ee333df548856ba8c3395ce2ef786f7f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144070, "uuid": "ca888662-bf66-43bb-92e9-1328b6e1469c", "comment": "Malware payload", "value": "f040b819c878369e1089c405ba854109fefca3e4", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617144070, "uuid": "d1bfd416-4d50-40b1-b940-aae52f6b6921", "comment": "Malware payload", "value": "088d395b6c931325edfccfbc7726a60ffde2fd819034b2ea161bc35a6f49f028b7859289cd3be9141be2cf109e133f6c", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144070, "uuid": "428f60ed-f754-468e-914e-3422b574db22", "value": "1914BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144070, "uuid": "78ddec1f-5fcd-4eaa-aeab-3c712cf7bc7b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144070, "uuid": "895ba294-6856-4264-a325-6cd5258a4f74", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617144070, "uuid": "ae29a202-e8d8-4a13-800b-d587b85ab016", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617144070, "uuid": "610ded70-e7dc-4b46-bd58-6afd5efb9a1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617144070, "uuid": "9b8274ad-3483-4813-8bfa-06e27d829b3e", "value": "92b77df5bda7db565e90e6dd93c86361ee333df548856ba8c3395ce2ef786f7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "387c3210-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120961, "uuid": "6199bfbe-86a4-4a26-b0cc-52614257e44d", "comment": "Malware payload (IcedID)", "value": "69d15c03a2b016d881c36d96e39f64c5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120961, "uuid": "e77e0b5d-78c1-4779-88c7-31d73406d953", "comment": "Malware payload (IcedID)", "value": "930d2b391df777d93edd3f76990159b7fb4bdb7bab22a337e96d6e74c491f5e9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120961, "uuid": "f451227f-7fcc-4ede-b1b4-efdb91bd7f86", "comment": "Malware payload (IcedID)", "value": "3e4dff46b8662e0dce6f8f110bd3112509823875", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120961, "uuid": "322b98c8-6601-4ab8-a42a-e5e5fb2a82dc", "comment": "Malware payload (IcedID)", "value": "a0b98a3e113376063905d491d6c310ef3b3e5b5a86d6aab3d0bcbc8dc607b5f05c75e0380b18109cb0db875e9851d646", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120961, "uuid": "03499d60-55bc-4c63-addf-0ebbd6dd10c7", "value": "F6B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120961, "uuid": "f371d15c-42b0-4819-a05b-b375c6cbeb64", "value": "3072:E2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:EzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120961, "uuid": "6dbd7131-7ae3-41fb-8c78-278da636ea3e", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120961, "uuid": "8880c61e-51c3-48dd-879a-b6f3622430fa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120961, "uuid": "da791ae4-bdb5-47aa-9302-f57dcc83e50b", "value": "document-1637964936.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99948881-917c-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617124990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124990, "uuid": "4f61aebb-5c09-47e8-be40-be964b19703c", "comment": "Malware payload (IcedID)", "value": "07f5262490186f6e390a6a204e492051", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124990, "uuid": "b0736a5e-a6d5-4ced-8354-39949bec9603", "comment": "Malware payload (IcedID)", "value": "938e7361910680ec9101be370084987f8abdbf1246a496cb89dfed9a52693368", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124990, "uuid": "412b8df9-1672-4d43-9cd5-479b254b5e03", "comment": "Malware payload (IcedID)", "value": "a8ade6a6d0c2cc7039cc3aed50707419c3ab881e", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617124990, "uuid": "0c76233e-b0d7-46fe-a8cd-4b554db59490", "comment": "Malware payload (IcedID)", "value": "e983bd2aa8d42745cd7f36b40ed010bf2870ba90420ee8de631b90f1e7fc7117d569f6fb79e6e35dd239d7ec2aed425f", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124990, "uuid": "44f77139-71d4-4843-bda5-12f3a342b37f", "value": "02B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124990, "uuid": "00d4ca72-79c5-455f-a083-4899cdb30da8", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617124990, "uuid": "f2437795-312f-4827-b796-da50f784f772", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617124990, "uuid": "b30fe869-5df5-478a-819e-e9a872a2c005", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617124990, "uuid": "5ffed09d-c1c8-45c3-ab91-86df8dcadf7a", "value": "document-1557875692.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ffeb0d-91a8-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617143749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "a26cb341-75f1-471e-9a45-6b3b0df7d6dc", "comment": "Malware payload", "value": "243ce4092267560c89b494ffe4b00c4c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "2c5af290-8e98-4684-884a-2923a5be73d8", "comment": "Malware payload", "value": "9392e37b364e36038b4c229f4b766ffba9ac4fb159979449b492070e559eb3ac", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "7873d3bd-e160-4ddf-86ff-b27e445cc742", "comment": "Malware payload", "value": "1772c9dbe223c2dfb7ffa267818b6836b21e5e53", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617143749, "uuid": "de584e7e-6abd-42dd-8d50-ec3245cea10c", "comment": "Malware payload", "value": "24e48f0b2a586b6824ab7cacd323b2091ad4224659dd928d0967c625de4622999dbc6d0af49213e4486602074bb7a9c7", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "9af03baf-75d3-4af4-9188-34bd23e8d70a", "value": "0014BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "cbdb70c9-e0ef-4b3e-ba8b-b555d6c9816c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "4e8f869a-6eca-4505-8582-447c7ca9862a", "value": "3072:Q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:0Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617143749, "uuid": "e0331882-3fd3-41fa-8e8e-07756988da85", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617143749, "uuid": "0cb5b734-5af3-41fb-99f7-f5d2f7190c2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617143749, "uuid": "714e5732-3b91-4211-8c3c-9bbb0a59d387", "value": "9392e37b364e36038b4c229f4b766ffba9ac4fb159979449b492070e559eb3ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fac1292-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (RemcosRAT)", "timestamp": 1617108679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108679, "uuid": "4974a075-c60e-4532-bad8-d97213da7f6f", "comment": "Malware payload (RemcosRAT)", "value": "83c9cee1f209ec02934e3895d5c51dfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108679, "uuid": "4f944845-34a7-4aae-936a-92a0edace7a1", "comment": "Malware payload (RemcosRAT)", "value": "93e8c5b7f7c4b18efb1f1c09c5ad9c5d8782611b9417f19063cdd17f3cdd92ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108679, "uuid": "d63bc0df-14dc-4e81-bab8-5df2b1931648", "comment": "Malware payload (RemcosRAT)", "value": "2ba1dac5e2fef7a948b21efcc267b3096656cf68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108679, "uuid": "984f13af-fedd-48db-8e35-b88eea48fb7c", "comment": "Malware payload (RemcosRAT)", "value": "98527f53264edb125bb8daba000f36e159220b9c82d577718baa81627f01cf143ead48b88a9d26e9db76c46852f35907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108679, "uuid": "56230b1c-3912-4137-b19e-60e333c027fc", "value": "74D48E23B6508437D16319B4AC5B97A4AE25FF203D28EC8737F82E085F75791793A193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108679, "uuid": "6245f16c-478d-4a11-9867-1b2492e77a29", "value": "1348df303efcafad50a6f5b8c3aa3e4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108679, "uuid": "ad6101e4-82fc-457d-af04-b058d1510ea8", "value": "12288:bsO+MZAkQfZuFvTdtchSOgA9PBbh5pg+s9GgVu7Y:QRMdQfZuVTdafDZpODP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108679, "uuid": "1d37c919-ed76-4832-9e15-ebce9df4a0c9", "value": 632304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108679, "uuid": "b99acb12-23bf-4c2d-9978-b031bcd49015", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108679, "uuid": "3912d3e0-7703-4b16-b967-ed5ef6025334", "value": "Attached pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c527ec3-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617133074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133074, "uuid": "5b20d3a5-3c9c-4055-8501-fd5db00094e0", "comment": "Malware payload", "value": "67686974340891bd803e7438e73bd494", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133074, "uuid": "2607ca75-f230-48ce-9c61-5b2fd2f5ca33", "comment": "Malware payload", "value": "93f900a6678c95c57decc0ff074c1846d31972e64629e1bf3003772aa7a04a3d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133074, "uuid": "28395603-ffab-4ab0-807e-9a235e75674e", "comment": "Malware payload", "value": "0556ac297c39e883d04caea2d7200ebb6187c72e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133074, "uuid": "86f57e73-3eba-491a-b203-ec10e3a17054", "comment": "Malware payload", "value": "0e889c3b6c65a104790f814732f403dd2c915b82e29e5cfe18a534017b7467cb2d026bb101395ab7cf74acdb50d8d3b4", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133074, "uuid": "9eeff3dc-1820-479d-990c-cf214ea6fa17", "value": "2614BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133074, "uuid": "50583344-4878-4df0-8464-113a80514ceb", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133074, "uuid": "09ce16eb-4d8f-46eb-981d-239755812d31", "value": "3072:l3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:lJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133074, "uuid": "f53f4d4d-6f7d-4993-9bff-5e79944ea49d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133074, "uuid": "cce78668-2d28-4812-8ba7-2668073bda8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133074, "uuid": "c7a692ed-1e3a-4dd9-8667-2228853a8c41", "value": "93f900a6678c95c57decc0ff074c1846d31972e64629e1bf3003772aa7a04a3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed546e8-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120301, "uuid": "f2b21113-a5a6-4982-8e37-77c582327109", "comment": "Malware payload (Dridex)", "value": "9bc8ee291fa57242fe8db856a6d4e1f6", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120301, "uuid": "d2cb4b96-efd2-450e-a85d-d747a0090c66", "comment": "Malware payload (Dridex)", "value": "944295f182e495775bccd0a19aadb06f449d106c08dff811c824b65e6127ce03", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120301, "uuid": "c0ea38bf-7035-45a9-b12c-afc025421941", "comment": "Malware payload (Dridex)", "value": "8bfc93abcf5589f37a63dc637231a029c43e0fd8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120301, "uuid": "f09c188a-0024-414c-8102-c9281773d3cd", "comment": "Malware payload (Dridex)", "value": "2a3753b9c4827091c494c252f9ce559a61a1066d2e306556c4180dcf758f7523cd83cf10a03121e60a0bb2e75b58ffa5", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120301, "uuid": "7820b4a0-cbb3-46bc-a93d-87879025e16d", "value": "FE14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120301, "uuid": "f4520692-a0c6-48b5-8ba4-96308c9436df", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120301, "uuid": "9a111ea0-e512-47b0-88db-b90fa43f079e", "value": "3072:53PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:xJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120301, "uuid": "89135d57-7739-4e4b-9cdd-e07969780074", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120301, "uuid": "226c1459-5f7b-4ad9-ae3b-64d232f2f58f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120301, "uuid": "e5736f5f-c649-4cc1-b014-4001710dff78", "value": "944295f182e495775bccd0a19aadb06f449d106c08dff811c824b65e6127ce03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e371e59c-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617108793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108793, "uuid": "e77306c8-8457-44b4-bb2e-0ce17e0386c6", "comment": "Malware payload", "value": "b72431bb8949648bc26afd0dd3030da5", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108793, "uuid": "54b68f62-cd65-4a9e-bdf0-823791e0c620", "comment": "Malware payload", "value": "9444b76a877f478aa494d27b38292459f9827f2e4b1e780ddc19a39564fbbeda", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108793, "uuid": "9734119a-4c19-465b-8f63-f9d1b0affb72", "comment": "Malware payload", "value": "c42bd7426e4d2021af74971417dc5e2d7d46319b", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108793, "uuid": "3194a42c-c936-4bd4-94c3-53385f1062db", "comment": "Malware payload", "value": "5825b891581cf66efd71bf21c73bff56f598a4d151fa924f340c8ebde5e515ad66ed0594842571e760e002b6b3ba3c70", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108793, "uuid": "0f8d5f87-64b4-40e3-8d88-5603f88fad1f", "value": "658312845A84EE859549A8FD9F6223B847FCD891717B9E0BDC87A4ED0EA38085D0CDC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108793, "uuid": "679057e5-6d44-41ac-baf4-64bbbb482193", "value": "1536:kfRf70ApNcRLy0KtnxM32i/LpNjY16J4PVp7xA7d3srMuNKa6z2qEo+Z:kpT08FtnxbO3o6yPVp7xvrMBa6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108793, "uuid": "a61e4b25-3cfd-4835-a178-e5d8d92b61a2", "value": 87021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108793, "uuid": "45e26219-f47d-4799-a406-af84a409bc14", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108793, "uuid": "bd70c900-209e-4eb5-89bc-9981af9566d8", "value": "lista_2203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea12ec9-9121-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617085807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085807, "uuid": "09a70c75-cf1f-47cd-8d88-2c2ea16ccdba", "comment": "Malware payload", "value": "9d96a605d15b9406390bbbf55641b63b", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085807, "uuid": "85988c76-3a6b-403b-9ccb-b6c8e3163933", "comment": "Malware payload", "value": "9497cd6255b025d3d63625dc385ce14c009458e144c8cbd72b5b1c7c2d8ccc10", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085807, "uuid": "cdfad435-9127-4fc9-8ca8-bdbdddace7e9", "comment": "Malware payload", "value": "50d3df8394109ccc39c39f7a4e5f1496f170b8b9", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085807, "uuid": "79107a3c-71c5-429b-8aec-30aeaaed4e8a", "comment": "Malware payload", "value": "8f757d8a7f5820f237fe5575c961e1a00f8f6bc252a9fb08b17a339e6889cf97d8763a2f3a0255367719def0e626e5ff", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085807, "uuid": "816becc0-3299-4876-9227-526aae9ece76", "value": "FCA423D6BCB43EB562056F0D13E0E708E91283A0B5E4F206D763BB87A42BB755E0467C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085807, "uuid": "045c483b-68b0-47fd-909c-afce1f3afa2b", "value": "12288:ewfsI5ogBFDHG0FFNS9pIUc7USp/1xtp/W2JU3:eI7bDm0H8LEd1xtp/Waw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085807, "uuid": "1cfb0085-4600-4041-b0e9-2cd160a16b4a", "value": 453952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085807, "uuid": "9df50051-938a-41c8-9e93-581a0ca442c0", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085807, "uuid": "19bca350-6a08-4e2c-badf-8573a073fba2", "value": "doc.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1683b10d-90f4-11eb-abe1-42010a9c0039", "comment": "Malware payload (BitRAT)", "timestamp": 1617066358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066358, "uuid": "3f2f5469-8f75-4514-ab3d-e1d694b7c86c", "comment": "Malware payload (BitRAT)", "value": "f74cd92036bffdce1d705ad0712247a7", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066358, "uuid": "6400ae5e-1be1-4837-86ac-105c750980ab", "comment": "Malware payload (BitRAT)", "value": "954f62f0014b51953056dd668441cd4e116874fd6d6c75bd982ba821ea6744eb", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066358, "uuid": "163c4623-cefb-4d9e-9a6b-6fe5ddd41ee6", "comment": "Malware payload (BitRAT)", "value": "9f23b64963d37d56504bca1c16f0d981a0441788", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617066358, "uuid": "e5f218c1-06a2-4a90-a958-e8ac24a64197", "comment": "Malware payload (BitRAT)", "value": "99effc3024ae027ff2b9e97ae334e977697283cdde26f25a4be1af6cbf3a4c5c93272a63085f712328a5f39d52b64f4c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066358, "uuid": "2d75931d-7f15-482d-844c-93c4c6896a97", "value": "DA95CFDAAD888EC0D4B2F2F0E44A866207A51C55E88C46CC4DF97DBE45794A7EC1B43F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066358, "uuid": "62cd9eaa-1c2f-4a4d-8ba2-4f4520b6b91a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066358, "uuid": "27b45c34-0328-419e-8a69-ad543098de2e", "value": "49152:kTO71WkRJAldSE7KsqqNDWNiocAe3SSR0o6y2p:hbRJAlddWsqqNDqiVAuSSR0o6y2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617066358, "uuid": "2ff33aa0-9048-4622-b3aa-c7ad09cb9c07", "value": 1927152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617066358, "uuid": "45f197a9-b0bb-4d64-a8ff-d00559799c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617066358, "uuid": "cac36c11-93b4-473e-8cd9-2ab9965b8bef", "value": "f74cd92036bffdce1d705ad0712247a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132104b8-9164-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114456, "uuid": "13946619-ebf3-4c55-869a-933a2a41f8a8", "comment": "Malware payload (Dridex)", "value": "25e2ac5dfd2ff01a6b097ba6324f387a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114456, "uuid": "32613078-b99f-404b-b6da-517ed10d0401", "comment": "Malware payload (Dridex)", "value": "95605b3de082bcda476f63a6c1ab70712d0f35c23fc00bf6f85879de910f2965", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114456, "uuid": "7806dcb7-46e7-478d-b39b-963dc9e8520c", "comment": "Malware payload (Dridex)", "value": "10d58820a8e8fe19bcf282b0404c03a445d1f3cf", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114456, "uuid": "9f56f6eb-3ee0-4fc4-9f59-51396c7488f6", "comment": "Malware payload (Dridex)", "value": "45ce03971aeebb845f67d485525568b9a306fbaebcaf06a106e4bdf11042f4646fd1964d456d7ba3fbff32f3fe2f6d7a", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114456, "uuid": "a1acc3e8-de65-4cb8-896b-3d15de5fadb8", "value": "DB14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114456, "uuid": "2dadd456-d735-4ebb-9d46-47a08bd55bea", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114456, "uuid": "9853e8b7-c286-459a-8e58-a8c75adcb3da", "value": "3072:p3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:BJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114456, "uuid": "2bb5d083-8cdf-4e95-945f-db5bce75a469", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114456, "uuid": "109f310c-9512-40aa-b9c7-fc1df76af7b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114456, "uuid": "c25bdecc-255c-46b5-a47d-782352ff29e7", "value": "95605b3de082bcda476f63a6c1ab70712d0f35c23fc00bf6f85879de910f2965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84585bf1-9146-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617101761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101761, "uuid": "e57c2547-836e-460e-9920-c63c85cfcd03", "comment": "Malware payload (NanoCore)", "value": "9c772e57fff6c8713e2e83534a70f976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101761, "uuid": "274206c6-a684-45a9-8736-3147ce7d1e68", "comment": "Malware payload (NanoCore)", "value": "95a40aa92e46b3061abeef469d4a20f1c84f10b530d0f0c06f87f96d00f75ed7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101761, "uuid": "62f52d69-d48e-4666-ac40-47abc906e3f9", "comment": "Malware payload (NanoCore)", "value": "e522d25556a8a1d81bd10272f4d8a793ddc5d238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101761, "uuid": "26cca0cb-09fb-437a-827c-dcacad9a40e1", "comment": "Malware payload (NanoCore)", "value": "f7638b4896823c64e1f00a8fc1e46dae8e4cd43aaf3db82ed6f6a682db186e5d2e535434c6813ac8014a7cb5f44854f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101761, "uuid": "426a96de-c843-4051-b581-e00542bad1d0", "value": "D4E4A2A870AE405DEEB46634F6B695821FC855321F62FF3F28D667001CA3779FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101761, "uuid": "a47ef241-4c74-4ec7-85a7-1c9b0d373226", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101761, "uuid": "0cad4391-ac6e-4abe-9277-9de4e116b922", "value": "6144:GBnEV9oAO+TXzK/ZRLsAiLWo0ESryM/iHjheVzaw9BVEdVTnPAFODw6mr1ZyIIpG:Co9OR/ZAXSOpDhON/m3PA8Dw6mrnx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617101761, "uuid": "a6928616-e44d-4ada-b8b5-72ae64b0e721", "value": 691200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617101761, "uuid": "cda371fa-e4fc-4380-ab8a-71adefeafd4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101761, "uuid": "8be06773-b000-429a-977e-e52ea3fe1634", "value": "PO-290321 (Itakrom).pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d2a643-9167-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115810, "uuid": "e1829e25-b58e-4925-8949-afc48b5c777c", "comment": "Malware payload (Dridex)", "value": "4905c9e4bd54b6584427f1a9d0761962", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115810, "uuid": "9698f36f-4818-46ef-bb2b-29cde5c1973b", "comment": "Malware payload (Dridex)", "value": "95cc0b589d9230e24c0fd8eae03e4983b71f7c7ab29686e4a703eafcf795aa76", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115810, "uuid": "a95a2d5a-a64d-470c-bf3b-ea93c3f93c91", "comment": "Malware payload (Dridex)", "value": "6c8f56ecd296b5e5bc1eb0121cde0453a7ffeb64", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115810, "uuid": "2382833c-d013-43b4-8784-1a5272111c80", "comment": "Malware payload (Dridex)", "value": "46c12b2ec77e7daa23c966f7622a5e5c18c6e8a446e8f3a0af0aa7887ef1e890bec0763b57548787205ca9e8286bcb73", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115810, "uuid": "2246361d-47a7-47c7-95ea-76deb3ba97cf", "value": "1B14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115810, "uuid": "dafed64c-bcba-496e-8015-f3ef34015fee", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115810, "uuid": "38cedc53-a938-4cef-b677-7bc9bb5878e2", "value": "3072:F3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:FJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115810, "uuid": "a600d9bc-dc95-4c05-9b85-cb17fde5f15d", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115810, "uuid": "21726e22-d60c-4c06-987e-4d6b071f16c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115810, "uuid": "8fdd6e8c-c219-4967-9d35-da1904fef01e", "value": "95cc0b589d9230e24c0fd8eae03e4983b71f7c7ab29686e4a703eafcf795aa76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc40b3e-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114370, "uuid": "5276b34a-65a2-43cb-accf-47707b728fd9", "comment": "Malware payload (Dridex)", "value": "d8f53614e0c778a8fb1694e347392def", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114370, "uuid": "379810b5-f3a4-4091-862f-db9772b09d8f", "comment": "Malware payload (Dridex)", "value": "964a5c596288357c6860034b7a90baef1203b9a968ec3ff33ab7980127d9ec71", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114370, "uuid": "02340127-aa03-417d-bf43-e61980f447f1", "comment": "Malware payload (Dridex)", "value": "ddc2fde324cdf4144e1233956c1ae627a2072238", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114370, "uuid": "421c69ff-59f8-45d7-afc3-c003a6d9f2d9", "comment": "Malware payload (Dridex)", "value": "5d04f40cadd013185e140ccf240b066e674592567becb01560b8b2de6724dbb6eb3d604de032691ceb13e5b0009cc877", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114370, "uuid": "1aae736f-2d1f-4bc8-aeb9-46b7c6b21eba", "value": "CB14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114370, "uuid": "e3341fb3-eee9-4fa7-93b0-3fe86cfe16d8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114370, "uuid": "d1fb7b93-90b3-4cf8-b3e6-66af9e61592b", "value": "3072:63PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:+Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114370, "uuid": "a1a7a2e0-42a1-457a-9026-a1ef15505d6c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114370, "uuid": "1bf3cb06-b592-4fd6-b8ce-8eea2174a0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114370, "uuid": "ef6b875b-ae76-485a-a273-d249aceef1cc", "value": "964a5c596288357c6860034b7a90baef1203b9a968ec3ff33ab7980127d9ec71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6fe79c3-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115268, "uuid": "4c19f805-6aee-47c2-bf57-84cc207b5be4", "comment": "Malware payload (Dridex)", "value": "5ee3e9d89969f01a847133ceb8792202", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115268, "uuid": "b1b39c12-fc3e-4e0c-aca4-8bfb9bd53849", "comment": "Malware payload (Dridex)", "value": "965061d5ab717f1f35ce31d735aff762eb6e7e463ca5ab0c46f2f891a0be679d", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115268, "uuid": "9f110fb7-bb87-494e-ae77-d3d3ce4001bb", "comment": "Malware payload (Dridex)", "value": "725a7dbccc8152746ab1052a4cfddf8c0e7e0902", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115268, "uuid": "756cd158-d82a-432e-9232-1a431c97b42b", "comment": "Malware payload (Dridex)", "value": "19c0b8352fd2e3ad7c1d0c7ad9ddbb362f61d5f70aa03dcd04dfcfcbb95bc36f2222027af828fc726053b598e2f2fcbf", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115268, "uuid": "b4cdef2e-8c0d-4a4f-b0c3-c3d8618005df", "value": "B114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115268, "uuid": "0363de66-c1f2-4ab6-bd3e-92f690301965", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115268, "uuid": "bbce3bfa-ed5b-4e94-b07f-3d3be413e865", "value": "3072:k3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:AJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115268, "uuid": "f7647a62-6a1b-423f-9170-333aaffba396", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115268, "uuid": "7a76eb03-7e58-4f91-9a8d-b058f5a47cf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115268, "uuid": "c9e4abc8-85e0-42ad-b5ee-752de351cca8", "value": "965061d5ab717f1f35ce31d735aff762eb6e7e463ca5ab0c46f2f891a0be679d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f92e92f2-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617083060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083060, "uuid": "54b2bacb-9c9a-47ec-9169-02a750367e91", "comment": "Malware payload (AgentTesla)", "value": "85acf2db6b4132bff40dff220b39fa31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083060, "uuid": "e0ca3fd8-4511-424d-bc2b-b006dc85abee", "comment": "Malware payload (AgentTesla)", "value": "965504bff8dbe047149efa3e661d859d87b543774f5d0d25a19219dc9be40cc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083060, "uuid": "63f68eb0-fc06-49bf-bdc9-df18b468b63a", "comment": "Malware payload (AgentTesla)", "value": "f8e89b5e3c2a1b6dbdbc603b2bfdd544874a8bc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617083060, "uuid": "d0724023-772a-441c-817d-be8023976c17", "comment": "Malware payload (AgentTesla)", "value": "5dad392f66f7beb0a195eee8fd7e0f0c823999f212bfe11eb9e5ed370ba5e88dbc1e1ebc8db145283527c8e89b69fe97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083060, "uuid": "f4c2f891-1655-4de4-8f9d-7369a53276d4", "value": "E1E4A0A870AE405DEEB86734F5B595821FC825321F62FF3F28E657005CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083060, "uuid": "2a8f86ef-ee4d-4361-b8ee-51ae14fa9026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083060, "uuid": "6176999d-9312-48ed-8a16-3236e52ead10", "value": "6144:oawpeOKYgZhaenvT3w2FtSbLDyY9SCBaA+UR1KMGKRnCXfPYJFkd+bX1mzCwkSJ9:iaZhlFtSPDdTRjrTbXgC9YO2uUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617083060, "uuid": "12dcbbc0-f1be-4b68-a885-5bc2feb3eebf", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617083060, "uuid": "45b98da8-9c2a-4513-98f6-291eca942b51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617083060, "uuid": "35b736a5-4dd0-4e1e-8068-d62077c52e02", "value": "CI-210318L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39f90f3-919c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617138885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138885, "uuid": "e395a24c-d5e8-4944-9d0c-6f99483d0442", "comment": "Malware payload", "value": "2e196ddaa308451b980892371d9d9852", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138885, "uuid": "cb649299-73fb-40ae-9186-fc06f322e199", "comment": "Malware payload", "value": "968e44af468dc9fb433961a63eb10f6f6e7bd89038e4e16a6fd0b46ac47b9737", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138885, "uuid": "3dcaa4cd-1529-4b28-bf1b-174f4142df21", "comment": "Malware payload", "value": "3c3796a74a04e3d7b46ba11cbdabd1ce12b1e3e8", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617138885, "uuid": "a69236c1-b05f-41cd-92f5-20263c6ea52b", "comment": "Malware payload", "value": "a8f4ccad67cbb2d47b7e7d8775fc96e2907da1dc84dec9bab79d69860bbe786cb6d1153571581959133191a11f2e2eb8", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138885, "uuid": "2da64348-372e-4c4f-9eec-24997b640ffa", "value": "2A14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138885, "uuid": "d43c5ea3-b6c3-4c33-9c96-f1ef1f7b37a8", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138885, "uuid": "d25b2d7f-13b6-402a-8ab9-7e1d8502aa1c", "value": "3072:V3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:1Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617138885, "uuid": "e4137e9d-98be-4bce-bbb9-08e6d27593ac", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617138885, "uuid": "94ae4c33-8ccb-48ee-87f4-006b334b324c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617138885, "uuid": "2a53d31d-7ae1-410a-9a2b-5c107d1acdca", "value": "968e44af468dc9fb433961a63eb10f6f6e7bd89038e4e16a6fd0b46ac47b9737", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "551d879f-9196-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136042, "uuid": "4613d20f-216f-4a51-be81-0e6780a3cbce", "comment": "Malware payload", "value": "90a5a7374dd207d675d4af2015218668", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136042, "uuid": "ba4695e5-fe30-483f-a9e2-0b499946decc", "comment": "Malware payload", "value": "96cadb1034983aecd66f96ac43776a7def9aa2fb07d0bff6dde77478ed28c98f", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136042, "uuid": "480b5157-8575-4aa6-b364-0ef5dfbe47f4", "comment": "Malware payload", "value": "7c9e61605ca1a5b77809d9ff613c4e9227fcbf79", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136042, "uuid": "9bbcf34e-5cf7-4112-be4d-b4a96512c9fd", "comment": "Malware payload", "value": "66d6d1bbd54ed22e44e15aca7fd43db62a25dfb152e0508e6609a01e9e584f93af18c09b60cd9b88b9444ddfe7fedf69", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136042, "uuid": "ac99b1fe-fd0e-4e93-ab34-e741d260f3ce", "value": "0914BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136042, "uuid": "f610ef48-2217-422f-909f-5f3216ca09a1", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136042, "uuid": "fd3990d1-9af8-41fc-a848-213d9464cf5e", "value": "3072:K3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:uJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136042, "uuid": "c5ccc04e-8fdf-4f3e-af91-53efb8ef44c0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136042, "uuid": "f4f640d5-b5ca-405c-a12c-b2c259bd7e9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136042, "uuid": "e1b7ac21-e607-4033-9417-348c22d43a1c", "value": "96cadb1034983aecd66f96ac43776a7def9aa2fb07d0bff6dde77478ed28c98f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ad804c-9199-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617137382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137382, "uuid": "40bdfd02-511b-473e-8f8b-aee989165457", "comment": "Malware payload", "value": "3650594028d3bd0fe5a65d991a2787cd", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137382, "uuid": "218c30a7-354c-4430-9082-520ae433c478", "comment": "Malware payload", "value": "97122c53acee1f1468b9e4bb2cc9f8da32f2af14fc915fedb27ada6366845505", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137382, "uuid": "4648810c-2287-40b2-8ea0-2eb16aa6b4df", "comment": "Malware payload", "value": "d09e79ce342ce31076c2785229c5c226fdb1213e", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617137382, "uuid": "80d4900b-570a-440f-9624-88226f583436", "comment": "Malware payload", "value": "d79303420c408a33ec9a59745010b101d7b58feb07d6c8ea89e5fd2502c6987740ea868f71d6dd821250c75462ea73cb", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137382, "uuid": "c625e7eb-7154-4344-a9cc-b8995476e022", "value": "C114BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137382, "uuid": "b4f8a576-7afd-4558-89fa-d3d47697dba0", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137382, "uuid": "47d12b4b-00a6-41a2-8c4e-e0b42b0b8dfb", "value": "3072:c3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:YJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617137382, "uuid": "02d3c758-60e8-4ca7-8e90-290d95ca6d72", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617137382, "uuid": "1839e1b9-00c7-4c0b-a21b-6d99f05463b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617137382, "uuid": "c96ccd37-9c8d-4a6c-870d-8ccad602f607", "value": "97122c53acee1f1468b9e4bb2cc9f8da32f2af14fc915fedb27ada6366845505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cdbf37-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122942, "uuid": "5bdacb49-c7a6-4b93-b4bb-adbb178eceb7", "comment": "Malware payload (Dridex)", "value": "27846de7d939afd0c1d47135aacb06a4", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122942, "uuid": "1d21f3f3-3ba3-48d7-9dac-72acce6cf318", "comment": "Malware payload (Dridex)", "value": "97a6d692dd2f76ba88f5c0b9b4bc39b649b49e45349ecca8e908573238abe138", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122942, "uuid": "a5c0429f-1232-4fa9-9560-41d95fa0af55", "comment": "Malware payload (Dridex)", "value": "871b77d209ae97221dbeb509231810dc8d659dab", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122942, "uuid": "189efd3c-c2f9-45e3-abed-732264dee394", "comment": "Malware payload (Dridex)", "value": "816a23ecf4cec0c27b194864dba0ccffd0f2b7673ee06e7342a85c673e7365b6649097e66c461c6816d269109a10ecb9", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122942, "uuid": "f81c7976-fbb6-4651-a461-3041e962cd8f", "value": "9F14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122942, "uuid": "2ffebed6-238e-43c5-b677-415417d45597", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122942, "uuid": "161dba00-2654-4e10-be0b-89058c7fdf28", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122942, "uuid": "29b9d40d-9724-4cb3-972d-bcf6d1e5ff93", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122942, "uuid": "a01fe8a4-0544-47ea-8c32-06469fb186c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122942, "uuid": "f50d2cc6-5af4-4e1d-87cb-5ee60d2239a0", "value": "97a6d692dd2f76ba88f5c0b9b4bc39b649b49e45349ecca8e908573238abe138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b63fab-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108506, "uuid": "62a97119-20f4-4843-86d8-86b0709d75c4", "comment": "Malware payload (Quakbot)", "value": "653ae976b23e17981461345b9888416d", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108506, "uuid": "006acc18-dd53-43d0-9c89-1b70bc4a106a", "comment": "Malware payload (Quakbot)", "value": "98640a38c5a55e9774ab8f4e7146f9f0a34c1f88862d2f68124a0da6af4d470e", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108506, "uuid": "9e25372a-031e-4d04-be96-bae7ad486cab", "comment": "Malware payload (Quakbot)", "value": "9532c79b027e171d5421e055852caf295a20f8b4", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108506, "uuid": "56efdba3-6724-43cd-9ae1-a44683b99752", "comment": "Malware payload (Quakbot)", "value": "dc78981aeb9dc87f5fbc7ae452fb1984468faae669a240b1c4d9100afb4ab80049bde033d2bd11803c1e3618b768b448", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108506, "uuid": "fd9a8462-47b6-4a74-925e-ab87b7e4d7b1", "value": "22B3E08D72947A0BC3CFF93E5A06A4A748574080E51AB93F3AB4BF0D519814B0F9E59F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108506, "uuid": "2781ff0d-8036-4d57-8c99-292dba940f0e", "value": "1536:3QAy55MTeHCyyhrMg3wlNTZKKIzKe6XxkhTv7xVMsigZEQNggMorCK/6iwZk:gAy55MTyiMKKI/OQTdV/vEQSlcCwwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108506, "uuid": "f896b99e-d1fb-4833-ba28-c9199689bf43", "value": 108094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108506, "uuid": "bfbe7618-937a-4c62-b9fe-485cc694e20e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108506, "uuid": "bfaa633d-b088-46f3-94e0-37be879ff6e1", "value": "fisc_2281.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501e2970-9145-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617101244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101244, "uuid": "61753666-ebab-45e6-9f69-b5c2a80a3af2", "comment": "Malware payload (Formbook)", "value": "f04d2a73e6cbfa7448cddc8a720e8b7d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101244, "uuid": "f540a4cc-f6a1-40a3-9e2e-76a844748d22", "comment": "Malware payload (Formbook)", "value": "98a634da7b379b6369d5b7445c7aeb5a58aa195c8f088bf11c84c77ba2c972fd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101244, "uuid": "34443567-b1e0-4271-9120-e6e86b441cc1", "comment": "Malware payload (Formbook)", "value": "3383b7a9dd515561c6febf0450b079bc5fa01180", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617101244, "uuid": "d35459a0-0ce7-4a0a-ac0d-73a60a07fe83", "comment": "Malware payload (Formbook)", "value": "6b65de33727cee501dcdfa9d62219a657a317c15cd06d595cad05f9a9816e4ab1153ebf85cb3acc1bbf760b0817d8f54", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101244, "uuid": "c5d11590-8a12-4e97-8c84-6fec27f7a9cc", "value": "AF24124A39FA4853E55A447016AACF3AFBBBF11432904E2B1FFC5F7A4E05182DA1178D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101244, "uuid": "3ed80c6b-7741-4184-9b35-274e47095283", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101244, "uuid": "88fcdd9e-38ce-4c29-8f1d-cca0e6d41694", "value": "6144:nAPpDdteXz3u9TJdAuQFB1EKXwWP+W9pKDGP6c:MDdJJizFP+W9pKyP6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617101244, "uuid": "bb8d21f5-a206-4420-8fe0-b72c76701939", "value": 217600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617101244, "uuid": "296ac06d-4a22-49cb-90d7-b2a927b44600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617101244, "uuid": "56193eab-f329-4d3a-8828-efa7d603582b", "value": "SecuriteInfo.com.W32.Injector.AFV.genEldorado.24087.16389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2821e2-9109-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617075360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617075360, "uuid": "67419c20-fdb3-4506-a2b0-cdd1b0dbc27e", "comment": "Malware payload (Loki)", "value": "9f6c0c6a987abaacb494af3d14a93e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617075360, "uuid": "c5ae7a28-c3ea-4ab8-bb6f-7ac071b6055a", "comment": "Malware payload (Loki)", "value": "98d8ff5448a4eddc71e541ddf0dc68a3baa65fb4828ed542a0fa64ea46db16d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617075360, "uuid": "2d43a7b9-42f1-4f27-bed4-78ed08620a56", "comment": "Malware payload (Loki)", "value": "1c595ff8515ea902e3bc518c34f2060734cd0c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617075360, "uuid": "52702b32-50a5-4b82-9bd3-12be148de032", "comment": "Malware payload (Loki)", "value": "d5e449b3f755c5e404a18cb79c573f2a550db56e7fa5be40091e67a2a026f069eb77ae4164cc5740bead833d4a3189d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617075360, "uuid": "6cabb42c-7ec8-4fbe-8828-a62789fe4e10", "value": "DCF4F1A03998DBD6E63D67FA1521200057B8F7E62063DB4C8EC9E4EE246EF4C4DC5A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617075360, "uuid": "4e42af93-413a-4b42-8b46-d61bb259f069", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617075360, "uuid": "2a1e3a9f-be7c-4e25-8a96-9144c710df02", "value": "12288:8PVsBbeA7EGjra06CJdJSBAQjB1UScysICGUP61M9NrPG:OsxpBP76ChgdAyk361MLrPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617075360, "uuid": "3f5c5540-4a3b-4379-ba08-0967a7303dbb", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617075360, "uuid": "6a130be7-5f1d-4916-b50e-3199b51b320a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617075360, "uuid": "72a303db-8e84-45ee-b6d8-ef76a29872bb", "value": "DHLINVOICERECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cada266-9112-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617079415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079415, "uuid": "1802569a-4cea-4104-ba78-63516079e604", "comment": "Malware payload (Quakbot)", "value": "3c35a42ba9e00861c71e82c8b4be60d1", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079415, "uuid": "ef300da2-8d32-4346-b83e-d4f085ca8092", "comment": "Malware payload (Quakbot)", "value": "98eed23a08893158e4152db923bbc033a0090c68012ac1f41ad75a0914696c2f", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079415, "uuid": "1c22985b-ee93-4f28-b420-9e4d3360999e", "comment": "Malware payload (Quakbot)", "value": "76fdbb98051aef769eba631cfa69702d7157863c", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617079415, "uuid": "c69d30ab-9f24-4458-9d64-14ec47ce6f97", "comment": "Malware payload (Quakbot)", "value": "1c2bfa5aaf4b1d0e27a1ff89ae1766127e2d87bbb3611e4381d92595ab67a0ef96f7434a8be7d05b15e2cd033b3c2410", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079415, "uuid": "a0f3cfdc-169d-4b95-870a-7ab606d5dac7", "value": "47C3CF9EB250B169C36FF43D5646ACE21C471052A593B13F35B0BB09A4DA2C32F9F1AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079415, "uuid": "30fe3b3c-03b7-4a82-9a8e-6df632ecfddd", "value": "1536:S1Z/zCYUUrbTswL2BpaDw2UMmquJTv7xVMsigZEQNggMorCKC/SFafRLqalN6eX:2Z/ziU7swTDUMwJTdV/vEQSlcCl6FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617079415, "uuid": "621bd29a-4e0d-4c31-a296-52c2e8a026e0", "value": 127244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617079415, "uuid": "c4095749-c7d2-4041-83fc-4ae207af5b68", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617079415, "uuid": "c39da290-68fe-4d3e-af51-585353fac81d", "value": "impr_720.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65a223a-9179-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123750, "uuid": "59122b1c-4fe5-42ac-b556-df45c163cf08", "comment": "Malware payload (IcedID)", "value": "7926c1714a7407063e5eae4312365b27", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123750, "uuid": "aba7f4fc-1971-455c-9d99-3352d690dd55", "comment": "Malware payload (IcedID)", "value": "99206cc48f97b202681077e4ddb07e953e5690f884fc6fbd6a7ee2aedf445cc2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123750, "uuid": "73492ec4-a2f1-49f4-8307-b4720845e36e", "comment": "Malware payload (IcedID)", "value": "708ba964d8b32e0f38c2ea2b36a70f72bb1f6767", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123750, "uuid": "4fc318f6-5269-4a62-9717-5a9c71ce29db", "comment": "Malware payload (IcedID)", "value": "e87d3a0827265643cf08702b09239b96d07c8504f3b9af053fe94bea984744408f92a0cad5c8deac68b5dba4250cdb9e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123750, "uuid": "a05a0dde-010f-4e23-a0a0-6e57422c8ee6", "value": "3CB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123750, "uuid": "f54072b1-9602-4a49-b1c2-d6f4c42c2a74", "value": "3072:w2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:wzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123750, "uuid": "ba0a52e8-ec73-44fd-903d-e890a1d7b9e4", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123750, "uuid": "17742f53-d873-413b-8167-66d9993c3b6d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123750, "uuid": "4641051d-21c8-439c-875e-8ffdbd2a063b", "value": "document-2142917651.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e428494c-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (njrat)", "timestamp": 1617085601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085601, "uuid": "531b2351-8ef7-493b-b779-18e3904f59f5", "comment": "Malware payload (njrat)", "value": "fa67bba902d57a0ce5cfd4c49724e3b3", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085601, "uuid": "ced3f83c-f13c-48d4-8d26-567cb2ffc4c6", "comment": "Malware payload (njrat)", "value": "9937f44be32ce2c03bb1d1d2e572db2a7cc1388f9ce5c3508e9f2fd92bf36ddf", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085601, "uuid": "5bfb9574-8f4b-4286-96af-0ee2d26c2660", "comment": "Malware payload (njrat)", "value": "c7563527fa84655ef9390f248cc2b5dee235462e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085601, "uuid": "f9b97c5f-0bc6-4caa-826e-c04b81fc016e", "comment": "Malware payload (njrat)", "value": "010b19419f2486cfd3ccce21c253640a09b147b722effa6ee78b5a65b96b7c956a78c4e6c40754317669e2d9f52181cb", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085601, "uuid": "fc277a50-0444-4e57-b22a-791c45662f5d", "value": "7AD31300262B26E849B663DA73D32A387EF75EB513EA22D59C9CAE7345153F0F4C0625", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085601, "uuid": "93fcac41-fb48-48e8-8306-d9ad22b2e8d5", "value": "3072:T0KQkMEfKwa3KiRO9tfwWZRrgpJf38V+JAT6HUCBlCO:T0KZM6a3KaO9tfwW/C3S+06HZBlB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085601, "uuid": "f7bf4227-42da-4eb8-afdc-c53b30745a72", "value": 139298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085601, "uuid": "de2241c1-5fed-4850-99d1-d9eca7139b4c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085601, "uuid": "fbb1d03f-a0d2-47ee-899f-b3ce226fec6d", "value": "RFQ_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1881c44-9126-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617088093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088093, "uuid": "b113feb9-9f54-434f-ac6e-af2e7e659ce1", "comment": "Malware payload (Formbook)", "value": "6b7fa9d17b9fedeab401d5838441e7af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088093, "uuid": "ce04aa4a-a92a-408e-8ae9-9f8c78aeb8f4", "comment": "Malware payload (Formbook)", "value": "993b6766e9dc3b8a73be0756a6053da8c24e1148783c584299a5bfe2f7daba77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088093, "uuid": "5daaeb24-3abc-4da9-9746-27c7cbff7936", "comment": "Malware payload (Formbook)", "value": "fac92a0111bef0b03ae572a303c77fb25e9bba94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617088093, "uuid": "0757c920-49bb-4d45-9e90-709ea52c8b99", "comment": "Malware payload (Formbook)", "value": "541d8000219986838291602f1bdddf7e505966ed7a18515ec0985c4ecec9585d154b75bbb87dca20ae37e4db94b7c7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088093, "uuid": "ff33dd79-eaff-4562-9db5-a5eef47e0985", "value": "2D24126627F499ABD51613702A37977BE3BBB6943200A933A7700F5F7923282DC2315D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088093, "uuid": "01fae0c6-7ac6-454f-8591-4058d37d1066", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088093, "uuid": "5bc97951-eba7-4480-b6fb-afac4f2de244", "value": "3072:3Ts3BxJNmJlsdj6iM/tqzfGs2LWzWHcyNHJsi2+9Ddqxh/mNVzRuCGHBlxmi66c:3APpx6i3zfGsScspscJ0xh/i+CGhlc6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617088093, "uuid": "ce7a8716-000a-4074-a99d-af6c0e69a5d0", "value": 217535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617088093, "uuid": "86c5b58d-1e50-4505-80f6-c4fc7b148c57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617088093, "uuid": "4cfd9b88-74dc-4f6e-8a2f-15dd81e6c60f", "value": "6b7fa9d17b9fedeab401d5838441e7af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b97e03-9178-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617123400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123400, "uuid": "90e914a5-bcab-49da-a55a-4573cfb34ceb", "comment": "Malware payload (IcedID)", "value": "54c33106397c1c3a7c4677c25e23ff1e", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123400, "uuid": "4a96d2fe-e60c-4ed1-9ed8-bbf8708133af", "comment": "Malware payload (IcedID)", "value": "995bac9fd9a7734c7656fb9c12c2682e6614478aa33bedbfd2ecc2a96de652a3", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123400, "uuid": "cf8b81ed-3624-4f0e-a33d-0aea96244d31", "comment": "Malware payload (IcedID)", "value": "de3dbc6f02f91c28a2a504a93b8cddf9e144addd", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617123400, "uuid": "9c091022-bda2-456b-8623-d85f40dea2de", "comment": "Malware payload (IcedID)", "value": "74467f38ef97cee1a48318dc263e41427dfa3c4500268a4d28a62fe3548cbc3432d6757f4671c7c4aa7162f2de02879e", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123400, "uuid": "1e089b50-6289-4e09-ab06-adf2f10b90a5", "value": "5DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123400, "uuid": "fe36de43-c2fa-452a-a8a1-172e2a58c048", "value": "3072:62CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:6zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617123400, "uuid": "f9775206-c8c8-4dd2-ac7d-f51be3be1960", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617123400, "uuid": "056eec4b-bd74-4b5f-9aed-17e1cdfb8847", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617123400, "uuid": "762c6363-a23e-4eef-99d5-b5a584cb050c", "value": "document-1330995432.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1858f5-918f-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617133151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133151, "uuid": "1fa17f27-fafc-45e8-aa47-050cb90645c6", "comment": "Malware payload (IcedID)", "value": "0a400ea191272b1a4c2b217dcd1659f3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133151, "uuid": "f46d14cf-49e3-4a08-99b4-69f49da44b54", "comment": "Malware payload (IcedID)", "value": "99e10496b842053ebd40b6dbc12ce886c853e33e8aef1a1642cc4b73d3da3cd9", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133151, "uuid": "a06dfcb2-2a81-45cb-8210-ebaff4132f14", "comment": "Malware payload (IcedID)", "value": "3eb63fe9fb468858550e6902754f64c93dcc99e0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617133151, "uuid": "49893888-03fc-4d58-90a9-cebfd7bf65eb", "comment": "Malware payload (IcedID)", "value": "05f139a9f469204e4635e9131e980fc6f4c4c8d0fc9f2718e4e81dde0f353045db8aa5071ab6f3faebb6542c55fb292b", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133151, "uuid": "517a5e03-123c-4b70-8fa5-19f02455058d", "value": "49B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133151, "uuid": "9c2357cc-dfbb-4dac-a3b6-6caca4499b0d", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617133151, "uuid": "1f8bae6b-4631-44db-8c56-47abd205d6b6", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617133151, "uuid": "1ee128ae-85b1-427e-8c09-32319382f015", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617133151, "uuid": "f10c3ce1-2161-43c7-a27f-55bbfe284255", "value": "document-448514234.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45079e68-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108527, "uuid": "227f6183-873b-4c05-86f1-d8334c2796e9", "comment": "Malware payload (Quakbot)", "value": "a44bcb5dc789b24bbf75faf97dada5c0", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108527, "uuid": "048348f5-5e21-4d17-8ed3-81e08f624bd7", "comment": "Malware payload (Quakbot)", "value": "9a0cc08c8a0365eb34db530ee6a8d371cfe29a7cd01c4526962ab3b05130d5a7", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108527, "uuid": "819b2968-de86-4e2d-ab54-060104dcd07d", "comment": "Malware payload (Quakbot)", "value": "f1e804a94a1bdf5906bf6336e2ebf894398e88a6", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108527, "uuid": "ae555dc0-0ace-4020-ae88-595515749bd3", "comment": "Malware payload (Quakbot)", "value": "a25b0db98e9431646bb9b43d49e61bf6e9072b151aa8b0281889a6c49fcc70c3f22378d0bfe249fd807a5e547cf35855", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108527, "uuid": "4835eeec-be4c-486e-80d1-e6b32710dfdc", "value": "CDC3BF9EA250B56EC36FB43C564698E21D461082E553B13F35B0BF0DA4EA2D32F9F19C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108527, "uuid": "ffab623f-48ad-449f-8a1d-1f5e59a3834c", "value": "1536:XltPsz7MgWz00au2BpaDw2GKTv7xVMsigZEQNggMorCKOfRLqadrqsN63:XTPRI0aYDGKTdV/vEQSlcC7rqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108527, "uuid": "dd30b7b4-d0da-494c-82ea-cfda0d995eeb", "value": 121573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108527, "uuid": "593852c5-b5ef-47a8-83d5-f23b41f59ccc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108527, "uuid": "3e6c1c9e-f44c-4908-8d87-e4cbeb21e2e2", "value": "impr_48.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75cf18b-9165-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115269, "uuid": "12b33fec-6458-4e2d-a69d-46f3a3b41bc7", "comment": "Malware payload (Dridex)", "value": "aab740a9bae7f26c13e4be237cd0fa8a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115269, "uuid": "06f35ee5-3fb2-4cff-a5b0-3dab0e005e6e", "comment": "Malware payload (Dridex)", "value": "9a2a42aba9aa8421f0fb85d57f80592d7314380b727778476075b88065f66d20", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115269, "uuid": "43dad204-6cb7-4844-b6bd-234e652d8355", "comment": "Malware payload (Dridex)", "value": "2e20033874483a734eda93db0b608e249491230d", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115269, "uuid": "81552d3b-a983-4aa4-b9de-b1dec621bb0f", "comment": "Malware payload (Dridex)", "value": "413a965d0d25ddf9704fad6393c2f1108af9bd76a97aac8c9b8ba5670c0418ae80e703c09f6399a8015219ebe9464eae", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115269, "uuid": "6a2c0efe-ba6e-4626-b51d-6a7f82cc02b8", "value": "8314BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115269, "uuid": "7d5443a2-8fa1-4c2d-b314-e708d5f4dc8c", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115269, "uuid": "1a4f061e-1060-4e9f-ace3-2b0dfe7f931d", "value": "3072:y3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:2Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115269, "uuid": "58484d88-49f5-4968-bba5-3232e53579d0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115269, "uuid": "1b6a180b-940f-4425-b0cb-0d03e33541cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115269, "uuid": "e54ce5b5-23a6-4f9d-9cfe-578f871a32ec", "value": "9a2a42aba9aa8421f0fb85d57f80592d7314380b727778476075b88065f66d20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce6cbc4-9173-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121291, "uuid": "6c2ff801-a422-4302-a377-3d4c07d4f85d", "comment": "Malware payload (IcedID)", "value": "33540f40df27d6c45fefca19c3e15387", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121291, "uuid": "b419b0dd-dc8e-40ac-953a-aab78743ef95", "comment": "Malware payload (IcedID)", "value": "9a2d3610442ec5ff27f0887af08523b5a6ba098b8fc110c58ae381c976b46946", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121291, "uuid": "e4992162-5f8b-4954-93b3-999059a0988e", "comment": "Malware payload (IcedID)", "value": "ab7c381b923dc88d27aa3672b2a7bc7abe8be98b", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121291, "uuid": "e1bc0fae-dad0-4783-8afa-9f3ca21787e6", "comment": "Malware payload (IcedID)", "value": "dafa8e8883a45eb9d833c6c43a78d05cdfced7fe897c4ba9a7cf28a2b123276ef19c53bd6d54f260ef142907525127bc", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121291, "uuid": "af73ad17-fefd-498f-95fb-75f50a9fcf5d", "value": "A5B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121291, "uuid": "e2177e4b-8c64-4799-84c2-88aee74f3343", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121291, "uuid": "7c5e9ec5-3f11-46e4-b2ab-f304ad799135", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121291, "uuid": "3eb6995b-4a0d-416d-9150-2e7cd3e56932", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121291, "uuid": "0f8cfd95-4191-4ed2-afae-e2dafc15d8f7", "value": "document-643033209.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11dcb825-91b1-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617147525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147525, "uuid": "4b56f858-b5ec-4a37-86c1-b5d80f1cd897", "comment": "Malware payload", "value": "29c7b6b0b6c6fc6d754394ac9d7d3e23", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147525, "uuid": "d862efbb-fc6f-4642-ad48-2c39ac31fae1", "comment": "Malware payload", "value": "9aeae1033368aabce4141fd82a5a2ac6395462e49abc275f75a5f066b18a066c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147525, "uuid": "ec431117-cb53-4319-8bc0-027bdc85c415", "comment": "Malware payload", "value": "71b762211c29ad0a858f272a8104c34cd4179c9c", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617147525, "uuid": "72852364-4aeb-45e6-90af-6184e2359167", "comment": "Malware payload", "value": "bbd76b9c3603a75956af353d2ed525eb118827028ddfc15a154d3d564c9ff253b1111076e8302ecdecc435ea0abdcc4f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147525, "uuid": "d6fa3eb4-b481-4168-8e3a-8af59499edc8", "value": "4B14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147525, "uuid": "d5ac45ac-3c85-4419-a463-4275df29ce42", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147525, "uuid": "2cea4c45-d819-4d11-b61b-5517461b8769", "value": "3072:53PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:xJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617147525, "uuid": "7b24e0f8-0d47-471e-a83c-87db7180f771", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617147525, "uuid": "9c80bd77-e8a6-4c7c-a536-a0870d4400df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617147525, "uuid": "42a2ec33-48ac-4dc0-a877-82c8ce4863e4", "value": "9aeae1033368aabce4141fd82a5a2ac6395462e49abc275f75a5f066b18a066c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adb96c84-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617082933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082933, "uuid": "05d6d066-c158-4360-ba23-8861505ed3b2", "comment": "Malware payload (AgentTesla)", "value": "1d693b7a49429beef44735fb5e3d3d01", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082933, "uuid": "a5de02d0-01a4-498d-b8b3-1ac596c0f5dc", "comment": "Malware payload (AgentTesla)", "value": "9b28e086223a3a91a2888e62924e0d7d93bff6e333ae07167fad3aad15c45fb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082933, "uuid": "71e6bd18-a634-493e-9d87-88019d6328d9", "comment": "Malware payload (AgentTesla)", "value": "a917013e5c0bd4a0facf6ebac205a64eb885f2cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082933, "uuid": "c94dfaf3-cfd7-4100-9aab-b8ce4f2e8e4e", "comment": "Malware payload (AgentTesla)", "value": "e765cf2b180d50e5e4956d0cb35a14e633295c8a8d533b6d14b095c4d5e8283cfda7ff5547b76704547d68bf625c4903", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082933, "uuid": "027b172f-e888-4b16-a60b-06d61cddb4b2", "value": "CCE4B1A870AE005DEEB46674F5B655821FC925321F62FF3F28E617005CA37B9FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082933, "uuid": "14c5ed00-73b7-40fd-95fd-5ef191944f44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082933, "uuid": "c555d29f-b2d6-4f9a-80da-15ff560590c6", "value": "12288:/SFZcyqeNqUyHZty2UmIIzMX7oaig8PKWiJKE6k5:0Zcy9qHby2UpIzMX0ax0YsLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082933, "uuid": "56b1c30f-6bed-4134-8e39-e186ac6497c9", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082933, "uuid": "cb46c4b0-ae39-47a4-a2bb-19bf4babd265", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082933, "uuid": "235733a2-7cbe-490e-a9b6-dc2140f88803", "value": "PO-0561.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79092fa7-9197-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136532, "uuid": "1e95d56f-3839-4fa1-8da4-617efc9b3fc1", "comment": "Malware payload", "value": "8129521fb069e508efe50c72d26aaf92", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136532, "uuid": "89322d89-e21b-4a43-80b2-8349ae94bde1", "comment": "Malware payload", "value": "9b53f831ec204bc4800048f4778d0708d1e82278fa7d5b2881d036e1f3e214be", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136532, "uuid": "e8de8cf3-b30c-44b1-81fa-36030c2ef986", "comment": "Malware payload", "value": "014ccdf7d9b7ba5fadcffca124e335929db56f34", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136532, "uuid": "3e886658-1b94-4cd1-bab4-4338b4dd2336", "comment": "Malware payload", "value": "dd8c206db142a14fabce360fca3c29289b4bd4ec9f8bad65a063ce24ceb297250a2d30c2ea23c6df0822a92eebee450b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136532, "uuid": "74b299ba-9f64-4a69-aa85-f0ca993a0907", "value": "0D14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136532, "uuid": "a5cc5387-67a4-46d9-90ae-c56a06795e30", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136532, "uuid": "f443bb5d-69ce-4a0b-a9be-388d8308ad18", "value": "3072:T3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:TJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136532, "uuid": "482ca2c4-9e40-49a0-99df-56cac3cd901c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136532, "uuid": "a19a35ec-536c-4b22-8204-21113e61d087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136532, "uuid": "fe1bca18-ec35-45cf-8c32-fc1de2f273a3", "value": "9b53f831ec204bc4800048f4778d0708d1e82278fa7d5b2881d036e1f3e214be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc7b562-918e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617132780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132780, "uuid": "009a3a1e-1c73-46d4-9ec6-24fb09b8a511", "comment": "Malware payload", "value": "a4476856abb37cb0096076d7ec3ed5dc", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132780, "uuid": "01134e7b-0739-46a2-a522-037a311a4635", "comment": "Malware payload", "value": "9bd8e65c3e57f27eedbdea6eaec5507686d04e9faac8133c22d7834423b8234c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132780, "uuid": "9ac3db3c-eb36-43e5-a81d-c915d309c5b7", "comment": "Malware payload", "value": "172b056040f5cabfbc680502a9c73d5891499651", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617132780, "uuid": "f9d9d589-7af4-42c4-b82d-c2bc4ecc1684", "comment": "Malware payload", "value": "e5a25fdf13f98c213c5dc9a85be14df1e6df496a68b2a46d8bd67eafbcc91b31cf43d4f426ea7f3772b967b28f0c0502", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132780, "uuid": "de6bbe6e-f260-42fb-9bb5-a690a1eadef4", "value": "8914BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132780, "uuid": "0b38c769-e29c-4bd7-95aa-e34d3bbe4a44", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132780, "uuid": "317ed826-e526-48d9-9847-5e0086690d98", "value": "3072:P3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:nJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617132780, "uuid": "92e671ba-fa2b-4f60-90f2-33a8a67917e2", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617132780, "uuid": "053bb696-bffb-41d2-921b-ab8ac17b751c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617132780, "uuid": "a9d1839d-4574-4b2f-a358-b7fbdd4acdad", "value": "9bd8e65c3e57f27eedbdea6eaec5507686d04e9faac8133c22d7834423b8234c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df35a7f-911a-11eb-abe1-42010a9c0039", "comment": "Malware payload (NanoCore)", "timestamp": 1617082799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082799, "uuid": "f8255e45-e2bd-4874-8d12-5fa442e9787c", "comment": "Malware payload (NanoCore)", "value": "eae0263557ed1c4ac31afa3dd7464a9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082799, "uuid": "84603d41-b9f5-4c96-bc7d-ac405e725ba5", "comment": "Malware payload (NanoCore)", "value": "9bf1de226886a9e56e08ebbf2fff0ac9f37a8e0f885a632539b62be8471e9094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082799, "uuid": "81b0240f-dcb9-4ed4-a15c-beff04dd1189", "comment": "Malware payload (NanoCore)", "value": "35da59fac8f9183e8932c9828f3cdc6f33d25466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617082799, "uuid": "f007a9da-b13e-44a6-aed1-c6faf56991be", "comment": "Malware payload (NanoCore)", "value": "4752f32692058257faf1deb2f2c142e4adec09382d59187736cf73b7a1caf39e570349da54247965ad6b1c56ec62b275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082799, "uuid": "3e997d00-2e44-4874-947f-606702d559a0", "value": "E41501A829A9DF90C5784BFB103120920BF5FBDA1123D78C8CC9F4DA1965F0C5ED9A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082799, "uuid": "f9e4e506-a5a6-4189-847f-6f04f17f061e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082799, "uuid": "7372eb9f-27b9-4e18-890f-0828c30019df", "value": "24576:MvlBS/dW4RxQeH8BrL7hnL19xgRpNyS+Hh:MdBGddRb+L7B19xnHh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617082799, "uuid": "29c51721-a71b-4604-bab6-3cc8b53cccbd", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617082799, "uuid": "30a75627-b33f-4773-b1f2-3caafd3097b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617082799, "uuid": "61c091ba-13ea-45a1-a461-d9cbf0532f38", "value": "Purchase_Order.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a50c3b-91a5-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617142353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142353, "uuid": "892a0e34-0268-45d3-a000-d005ebd8969f", "comment": "Malware payload", "value": "f03215d3b5e21938001cdf86f3b27841", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142353, "uuid": "cdb060e2-c989-4210-a6eb-9495757d8b1d", "comment": "Malware payload", "value": "9c379d2e6a9f89a6515215a563de00da07b0117db16b106120ddfcffa730d981", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142353, "uuid": "74b08441-fbef-4d5d-9a2b-b49802be9104", "comment": "Malware payload", "value": "27150f4dcc11d6ac3359b7685943b0dbfc848c60", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617142353, "uuid": "89d7fa24-9654-4c1e-ae65-24732ba056eb", "comment": "Malware payload", "value": "75942a68c9f4492ff4aeb344771c538c30f74f6a00d1b91d549aa1f7b4c27ecb8ce3281afb72c5952d141eb938d45030", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142353, "uuid": "b03dff34-fc78-46ac-884b-d67bb1a2aa09", "value": "D714BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142353, "uuid": "453b0ac1-3947-4aae-bd76-d2c7911bf4d5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142353, "uuid": "a9d94582-dc39-47f0-94f6-3fbfad28accf", "value": "3072:g3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:kJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617142353, "uuid": "7399236e-42b3-4ebd-ab92-2db6dadc60a4", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617142353, "uuid": "806d6828-c9e0-4ca2-829c-7996b534df37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617142353, "uuid": "70045c2d-acb5-4e2e-b8d1-506ef4168177", "value": "9c379d2e6a9f89a6515215a563de00da07b0117db16b106120ddfcffa730d981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf462a5b-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617114316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "36c82a0e-a1f1-4e8a-9252-2b0a358347e5", "comment": "Malware payload (Dridex)", "value": "be642572a41ca7890d0c12aa7ce2f81a", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "101a469b-3b63-4e59-8c4e-4c49520cae30", "comment": "Malware payload (Dridex)", "value": "9c667674250e08db52d0f1eb68cb193c37399901bb8901948f6d153c7c3dfb82", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "70907ea9-221c-4599-aa4f-92f1eba01c3f", "comment": "Malware payload (Dridex)", "value": "9969e0a21fe3a83596c684bee95e3d93d5015983", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114316, "uuid": "af1e114a-9b7e-46c8-9809-5051627b8b47", "comment": "Malware payload (Dridex)", "value": "c0cce2e2f14ba13dfb6bdaa8cda9eb00776f40554598759877c482aa3d518e3208a42a1d066c8fdd08396a1fc9956e04", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "a8e4d7d3-46bb-4792-ae1f-7f1b70528399", "value": "ED14BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "86cd30bf-2143-4d6c-8d6c-116c200ca1b5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "c6b8b590-1951-4caa-bc8f-2c78de315e60", "value": "3072:z3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:zJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114316, "uuid": "70899565-e988-4a49-97dc-d36844aa9881", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114316, "uuid": "c83183c2-c66b-4783-a175-24d77cba1e50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114316, "uuid": "7fd53856-6c00-41c2-9cd1-f5a81d2b4100", "value": "9c667674250e08db52d0f1eb68cb193c37399901bb8901948f6d153c7c3dfb82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e3b0df-9159-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617110028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110028, "uuid": "cbfaed1e-4f60-4661-9cc0-893d2170790a", "comment": "Malware payload (AgentTesla)", "value": "35826bc18ea67ef3210002769ea33b48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110028, "uuid": "e3102382-cdc4-4f4b-90d6-2f5b89402dc5", "comment": "Malware payload (AgentTesla)", "value": "9cdb924d27a8ccef7821491c5066f84b9011328b07f68fb8f805f3498cab4896", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110028, "uuid": "dbac0b95-114b-4dd7-ba2a-a0bf558979e7", "comment": "Malware payload (AgentTesla)", "value": "bb50317259beab84e5669638c00940b8b68207a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617110028, "uuid": "abdcea8d-71af-46cb-bf1e-6669cc7ab469", "comment": "Malware payload (AgentTesla)", "value": "017905235dc97531c0d67a5728ca3076d72ee4eaeba5e8ac2f9e31cdbd58a573f6a1f2f68801673e85581db3335dfd31", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110028, "uuid": "e5a1c1be-d85f-43ec-a93a-1b1168b372f9", "value": "0AD4B3A870AE405DEEB4A724F5B595821FC855321F62FF3F28E657002C63B79FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110028, "uuid": "1599bc8d-0c8c-4326-9e74-51054dd40584", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110028, "uuid": "c034f1da-bfbe-45ec-a740-6ece6772bd8a", "value": "6144:fJRafNLYyN9yP/2bX6PiaVaSsZCNlGuEJa2luqDCBJ99nUuCqggNMZdoma7gayI1:xcN9yPGSi+TeVCbBJTCqggNCemAga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617110028, "uuid": "1e7d00c9-ec67-471a-89f1-2484e7ab37d3", "value": 654336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617110028, "uuid": "8e04675c-c73e-4ba5-a5c4-7ab70398c807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617110028, "uuid": "9b9f737c-82f7-42a8-8cc1-d2c89abd2648", "value": "DHL_document11022020680908911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330928af-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "4e3a8db4-8830-4e85-81bf-3200d8e2dfd6", "comment": "Malware payload (Dridex)", "value": "4ddae772a7f183531c171a0099687e7d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "7e3937be-5742-4a59-a6f4-da827dc6b239", "comment": "Malware payload (Dridex)", "value": "9d056f0b67ee0878b8e6e281fc816fce18ebaf2dd0d1bf3f29a102a720b89912", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "e4a4b829-877e-4b6a-a9b3-3157683c1100", "comment": "Malware payload (Dridex)", "value": "357c289b1e9581c0c8d953b2cf47bedec3ef5757", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115369, "uuid": "e480e622-fa68-4699-8e5f-1397502674fa", "comment": "Malware payload (Dridex)", "value": "292f379b967272cd1f1600871aa9eda7cbcbd9619321818e04b6cc9cd87e2d2fe3ef3a961af1e7adf7611ef06a90ecef", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "dda14855-d742-4068-9a83-8f7012901866", "value": "B014BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "d6a06ead-7293-4b06-b6b5-259ae991c07b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "57bbb671-8c7b-4dc0-ad7a-958e77cbdda5", "value": "3072:x3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:pJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115369, "uuid": "5d960fe2-130f-4241-810f-2ff2e8aacbfa", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115369, "uuid": "0ad5149a-f47c-4693-8c47-c0b8496cc48d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115369, "uuid": "5d7ee278-7a65-434f-8c63-7786cbcce5ad", "value": "9d056f0b67ee0878b8e6e281fc816fce18ebaf2dd0d1bf3f29a102a720b89912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b4661c-9186-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617129032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129032, "uuid": "e13881d3-8331-41e9-b12e-badabbd86b1c", "comment": "Malware payload", "value": "310d97ae3c51e65ef6391ad6517ef304", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129032, "uuid": "ed869b11-a168-4b45-8ede-e1940d78379a", "comment": "Malware payload", "value": "9d0cb6d8e5b6cabbbc3fe5e47aceab1494c0ef9449200b6927333aa4d64166b3", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129032, "uuid": "418dfc23-8dd8-4758-9663-14640c3bade6", "comment": "Malware payload", "value": "910da5986dba928119913797543282914cfcb799", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617129032, "uuid": "594803a7-05c0-4cd7-a4f4-9cbdc878a619", "comment": "Malware payload", "value": "25ccc4c9172ea8d294e059cb16246908c3e6ac1ed9b7b271c6a4cc7d6249736d889f529a6975f75c2cd43a6a71081073", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129032, "uuid": "b2462827-17a5-4342-b602-b6513b693f9e", "value": "3514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129032, "uuid": "1c6f0d1f-9fcd-48c7-80bb-294a36b208c5", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129032, "uuid": "20fd1b69-213e-4af0-a1b1-249b6ee056b3", "value": "3072:L3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:LJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617129032, "uuid": "63a02a60-4243-41ef-a220-fc7b5426893b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617129032, "uuid": "159d341d-3a15-47a4-b7e3-d7b4aef98a01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617129032, "uuid": "bcd8daf9-94bd-4f75-966e-3dbfd21d78cb", "value": "9d0cb6d8e5b6cabbbc3fe5e47aceab1494c0ef9449200b6927333aa4d64166b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383303fb-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115378, "uuid": "70b18abf-ad30-42a2-91e8-6889408e961e", "comment": "Malware payload (Dridex)", "value": "86d7e5cc44013d2e2191cacc85f67a46", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115378, "uuid": "0917e8a7-3fd0-4ff8-b370-d2d8fea3e3ab", "comment": "Malware payload (Dridex)", "value": "9d11f5327b3238456f106994b09d7703c56453ae55136b608cc90d74dbb8478b", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115378, "uuid": "eec30fd5-bac0-4b01-9dd2-a6470759b2fb", "comment": "Malware payload (Dridex)", "value": "2fb9b97e59583802621f3801dc86c86bcb397f54", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115378, "uuid": "80c9fae0-16b1-4393-a65a-fbcf398c084a", "comment": "Malware payload (Dridex)", "value": "aded4627742c0bbbd712eb1875a32acf486560a07e9ccf45f0a51d57c9430f505d567f68a1e1066f78ea93827be30dfd", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115378, "uuid": "e3eaaddc-af3a-4307-bb36-e5601c6df0b1", "value": "B714BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115378, "uuid": "30905ccb-cfc0-4017-9b58-699057eb29aa", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115378, "uuid": "8f0aaafc-14a8-409f-9a41-e01cec4650c8", "value": "3072:T3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:TJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115378, "uuid": "a8b3517c-9ef9-4f28-8b67-68f390f887e0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115378, "uuid": "528f42a0-9e81-4cc7-9429-f0f223d175ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115378, "uuid": "5c5e71a3-d58b-4263-850e-6aa49d5030dc", "value": "9d11f5327b3238456f106994b09d7703c56453ae55136b608cc90d74dbb8478b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a10d5807-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120707, "uuid": "f8acc3aa-4a1f-4093-b3d3-5ef70e8aa19d", "comment": "Malware payload (IcedID)", "value": "a0332432f6eb1baaaffdb6ac33b0ee1a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120707, "uuid": "ed6c65b7-4ca1-4bfd-875f-70d302f7d1ac", "comment": "Malware payload (IcedID)", "value": "9d120ba048db3a2a2b2648077bdc7c03edb42be130248494626c47ef9c4bedd2", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120707, "uuid": "e82875be-b212-43da-9612-f97a2598dd25", "comment": "Malware payload (IcedID)", "value": "c89bbfc373f0d4c1633a3b90d5c565b3ee1bfb77", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120707, "uuid": "f0b5061c-663e-453c-985d-80ca34d218b1", "comment": "Malware payload (IcedID)", "value": "9c18e0e01bc00086a8c65a14f94f52778247294ad417b785e83f1d6f536c9d3e4f89657747659504c0eada414ef04220", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120707, "uuid": "85a74c00-632f-4061-8b53-2a387c2cbd70", "value": "88B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120707, "uuid": "d9ab0281-96d9-4bd1-a903-9dc571709f1e", "value": "3072:g2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:gzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120707, "uuid": "c4f1773f-086b-4ffa-b3c9-8a2caacdb772", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120707, "uuid": "bd937b8c-6a09-450a-8dfe-4e28f87a4850", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120707, "uuid": "dfeb07ff-554e-482e-b98f-e195df5eaa9e", "value": "document-1702816647.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54da1a19-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "442ec42f-bbc2-40a3-8055-29227c8ff7d2", "comment": "Malware payload (Dridex)", "value": "fcb0c17798c6a933d2de58fec1431937", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "aa86572b-0bca-4884-9b1b-1726ccc26b33", "comment": "Malware payload (Dridex)", "value": "9d95d21c017a647724a308e3236ed0e61c69d697a481e600fc0613dafb9c9219", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "6793e345-d465-4e97-b886-c5e939f53f97", "comment": "Malware payload (Dridex)", "value": "90b8f14231eb7dc8f6d38e78863e9d8d8aac1a26", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115426, "uuid": "0f541517-c4fc-434c-8ca9-6449d818c553", "comment": "Malware payload (Dridex)", "value": "3755f2c017ee9074f0134d7e80ed26911f78e65b99dda568772dd1820afd405ab3f3ab21b8c7a86ccbfd56943e2f132b", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "6804f401-5a01-4b94-bbb4-4946f3a848cf", "value": "9814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "1ba6f15e-cc21-4677-88c2-897a29de7d13", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "1173a3da-8d94-40c7-8e0a-7a33e5952535", "value": "3072:93PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:9Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115426, "uuid": "5fb55596-4add-4ad6-a2fd-83a1ce147f90", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115426, "uuid": "e7421787-6e15-4636-a2e1-a68150b86d98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115426, "uuid": "75a8c639-80a6-49e4-8f56-547437a0e73b", "value": "9d95d21c017a647724a308e3236ed0e61c69d697a481e600fc0613dafb9c9219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3382e08-9172-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617120711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120711, "uuid": "5b11ae7f-a360-40cd-bc2c-3651afa3d61a", "comment": "Malware payload (Dridex)", "value": "c3f34dd016d557e6959923ab83f715b2", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120711, "uuid": "e89bb172-8ede-442b-b999-3e3d3eafa2a7", "comment": "Malware payload (Dridex)", "value": "9db58ae7f4d9627d1874ae4f3a3e34243d22ca0968a78ff13f7e0647df6d2c40", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120711, "uuid": "1a5b1543-328b-4598-8307-b3b0fc86090d", "comment": "Malware payload (Dridex)", "value": "bb87210aca98cefe72f516f16bf1157d9cab5bce", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120711, "uuid": "a404507c-3125-4943-b081-4c98630372cb", "comment": "Malware payload (Dridex)", "value": "f9dd716e8adfc19380977f4cab18707729656af8f1211adc5a30b09776e0d7c6091f7cc0c5d480931746ee3b9e6ae6d0", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120711, "uuid": "df8fbc48-a782-450b-a247-fa028ca840af", "value": "2814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120711, "uuid": "38f290dd-6084-44e7-b7d7-514604b697d4", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120711, "uuid": "0ff428ba-e65f-4174-9de7-5bac9a651ad3", "value": "3072:r3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:rJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120711, "uuid": "59fd7ef4-abb0-42c9-9037-3ca5a08a008b", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120711, "uuid": "e657f0a5-67d5-45ba-b3a3-23561a888c2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120711, "uuid": "8596dbb2-b374-4c2c-a7e7-24a7aaa3a385", "value": "9db58ae7f4d9627d1874ae4f3a3e34243d22ca0968a78ff13f7e0647df6d2c40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e022cdaf-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108787, "uuid": "5968a4b5-ea0f-443c-88c3-f1e7c15900e0", "comment": "Malware payload (Quakbot)", "value": "4706d064b45d80c32d8e160acb0d4ab9", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108787, "uuid": "000e257b-56e5-4d99-bc55-b063a3af005d", "comment": "Malware payload (Quakbot)", "value": "9dd3aeb42d4e16fc684f529f9573dbff6c9d493134c7d28619f5b7d0420a95f1", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108787, "uuid": "4b437ab4-a9d7-46b4-ba2c-b0302182783f", "comment": "Malware payload (Quakbot)", "value": "be26c755468381579c99549681faff409d9c3ced", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108787, "uuid": "f3c4087b-24a7-4e74-8730-de230f180c7b", "comment": "Malware payload (Quakbot)", "value": "8ad2b5ab735fb092aabe58ca2c48ce1c54eac63140d5bf85bc76e7aa8be34b1f928e62ce087237beb497ad9acda292d5", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108787, "uuid": "6890cc0b-1825-4f78-8d21-5706979d4e76", "value": "3CB3D08EB284BA0FC79FB93D8A4265E70C630051A656B13F39F4BB0D95AC1870F5E19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108787, "uuid": "73ec4a54-4b21-41b3-8b77-fd1b08128dc7", "value": "3072:EYblAILwuS+yDTdV/vEQSlcCq5w6XrI81I:EYblAySzRd7ucC+w6X7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108787, "uuid": "49b5162f-3b89-4ede-99c2-715656e5bbc8", "value": 108011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108787, "uuid": "3db15c89-59a8-4e49-89b3-28ce3e915f29", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108787, "uuid": "a5ecfd59-2ea4-4059-8b70-b8efdafc5dc8", "value": "lista_2203.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5628df-919e-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617139487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139487, "uuid": "bac1412f-f988-4c42-9add-0722c716116e", "comment": "Malware payload", "value": "29f433f53f6796b827165119d73b09c3", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139487, "uuid": "3b9dadda-f3cb-4182-9789-89261435489f", "comment": "Malware payload", "value": "9e3af605cf827368e7de8096b0d06988cfbbaba37f52303c2f06e929023941df", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139487, "uuid": "46cde483-a6d1-4197-9b65-27dd97f6540d", "comment": "Malware payload", "value": "00a5e8bfb4a99ed52f946003d37c5403098a8681", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617139487, "uuid": "8a0a66cc-3881-42f0-a66a-0dd7f7607cb9", "comment": "Malware payload", "value": "d2ccd3c232bc9386c80550dc4a9f5d217f96c1077a32d07d4d18f88bcc490445b9de30b8646f78be7d9012d2bcf577b2", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139487, "uuid": "5486c1d7-c08e-4ab4-b488-19b250309f2f", "value": "6614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139487, "uuid": "3677c28a-f259-456b-b1df-b795d5d18dfe", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139487, "uuid": "b2131283-7df8-4229-ab42-82bb0f73c029", "value": "3072:+3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:6Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617139487, "uuid": "f2dca448-9dd3-457d-8633-2adae807ea2c", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617139487, "uuid": "8f539bdf-f8ad-42a1-9866-00151ac28606", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617139487, "uuid": "707145ee-110f-4f7f-bb20-65ff01c5a2ec", "value": "9e3af605cf827368e7de8096b0d06988cfbbaba37f52303c2f06e929023941df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9c6c7c-9171-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617120378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120378, "uuid": "a6fa2388-5410-449a-bb58-ec53e27ea41b", "comment": "Malware payload (IcedID)", "value": "970e00dff6c708818a340f7e36bdba00", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120378, "uuid": "d398744f-b7a7-41e8-abe9-20598fa3f432", "comment": "Malware payload (IcedID)", "value": "9e63de97e1a04ca31274b6668c7642bf9287654ad9fbf180b383ca3b32e29c7b", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120378, "uuid": "62f53a91-3369-4e54-9a2b-33e184410288", "comment": "Malware payload (IcedID)", "value": "c91370490d33e2f9e1558dbeb2ca53e1d3e43af8", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617120378, "uuid": "853b412a-7f44-4d4a-ac4b-1a5d4a517f11", "comment": "Malware payload (IcedID)", "value": "1198f4270dedee43d9131421ce0309fa71d7690324bc306987bf4e062036f42d55b76e41cd1e1bf1875af1714e374928", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120378, "uuid": "ba19437e-af08-4f72-97e5-18045d66554e", "value": "A7B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120378, "uuid": "99e60679-0bd6-4186-b146-67d1b4075301", "value": "3072:C2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:CzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617120378, "uuid": "23ffc32a-3af5-4e69-9140-5f29069e6227", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617120378, "uuid": "90dcba34-7e04-47bc-b894-baa44af4ab70", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617120378, "uuid": "93d98106-a1f4-4607-aedd-c8790572e6df", "value": "document-239132279.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8e34d9-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1617114153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114153, "uuid": "0dd35d6c-face-41ac-9178-0a4a92b2175b", "comment": "Malware payload (SnakeKeylogger)", "value": "b8cce7016014fe479177fe6ffa3cafb0", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114153, "uuid": "254439ef-14a3-4634-b0b7-72c8490fd81f", "comment": "Malware payload (SnakeKeylogger)", "value": "9e8e13d4d4166dfcc1fc5c661f80e446f7f63a62de42ce152f05de20b6ff649d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114153, "uuid": "b632e095-e3a7-4911-8fdc-35f8ac04b16f", "comment": "Malware payload (SnakeKeylogger)", "value": "2d9a0756d3191910f49a7917f03bc81ab0f25ac2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114153, "uuid": "84569383-fe4f-45c5-b949-35fbdca71f57", "comment": "Malware payload (SnakeKeylogger)", "value": "83875e9d16ba7e0d5daab51e84cda6a9c164b753db5a12083a03a4c3654e81129af4a9ac3f9253b7bae4f262fac98cac", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114153, "uuid": "6ad04d75-990e-4b21-a846-1f4d6c11c08b", "value": "24F4A1A870AE405CEEB46634F5B595821FC96D321F62FF3F28A676002C73769F94E910", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114153, "uuid": "cf04cf54-abff-47d9-b045-ad9830ab61ba", "value": "12288:W9Uu9p1c7gGs/BJoKoMcv/Yg2x9mFlKKLNImCU98nEZZ24y1F:KH1Yg3BJoKorAgGCKoqmCrnd4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114153, "uuid": "b2a95026-e609-4a43-b769-ac31c4056e6b", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114153, "uuid": "7d92b959-8589-4926-84ff-78244dc20ad9", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114153, "uuid": "f96a1d06-f21b-43f1-a678-7276141b872c", "value": "Dringende RFQ_AP65425652_033021,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d679717-9163-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617114098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "02ec79d4-c7c3-491f-bffa-011cb2e669f2", "comment": "Malware payload", "value": "378edc2e488d2b9d33c73f43f1b8863f", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "36063fdc-6e84-4192-a2ae-c07abd58bc8a", "comment": "Malware payload", "value": "9eaf29778b833b5b315e35fe1db61166282bb568d28bd5bf49f5f944b007343c", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "33195489-a722-44d4-bc5f-8ef91f5dbab5", "comment": "Malware payload", "value": "911c9b726f13a9adea5da4cfb0f2d1654a7894a2", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617114098, "uuid": "41e49eb0-9334-4bf8-86e7-04e76b7f202e", "comment": "Malware payload", "value": "8638c54d3045a1f6c651e3e25474f6d350078b512786ed405a962a51bcd7b28877fd2baa2f71ac50794997e6fa1b6d21", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "5f74034a-159d-494e-aa96-6a0c3a6f7e9c", "value": "D614BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "49837ea3-15e0-48bd-a8a1-8effc5ab58fe", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "b78d8bbe-7ecc-4ed9-a0be-cf41763589b5", "value": "3072:H3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:fJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617114098, "uuid": "85e75c54-2973-43f3-a3a5-b34f4407fd3a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617114098, "uuid": "31a9d360-b03b-430e-9fc2-63996083c5fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617114098, "uuid": "1dc79cf3-80ce-40fb-9323-073d66f44f39", "value": "9eaf29778b833b5b315e35fe1db61166282bb568d28bd5bf49f5f944b007343c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8666db-9159-11eb-abe1-42010a9c0039", "comment": "Malware payload (Formbook)", "timestamp": 1617109912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109912, "uuid": "51b1603f-44b4-4121-867d-166ee2d0cea9", "comment": "Malware payload (Formbook)", "value": "cfd33af200a1b0196d0c3ef448620136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109912, "uuid": "c1dd441f-4ab6-4283-a8a2-5614b1bc143c", "comment": "Malware payload (Formbook)", "value": "9eb105eb5a36975161a2d1926b6f8c099b57ee400c05d00df98335f4371bb28a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109912, "uuid": "e2a4d616-003b-4b8e-abc9-77a09a684f3a", "comment": "Malware payload (Formbook)", "value": "ac39997e37abdda6da54e9f7908d84b38843630e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109912, "uuid": "402aa3bf-afd1-48a0-bf2c-cad172bc69ba", "comment": "Malware payload (Formbook)", "value": "c454cbcdbeaa3cbef57f2ad2c6e41f6dfc66b192ceaabcb218196ef2f016f472f38c6e8d7c92fca9ef862e2e080fe91e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109912, "uuid": "ffb07372-c15c-4444-b96d-55ed689f9e80", "value": "4DD47EA870AE405DEEB46734F5B555821FC925321F62FF3F28E267006CA3769FA4E910", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109912, "uuid": "340c87e8-47ee-48da-a6f6-2d55e4ba8f12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109912, "uuid": "9e5f0e79-246d-4e17-9ade-362501c07ce4", "value": "6144:sa9HiFLGPBZxvob5Jhj9wmnzGmSGt8Lky4EXv09C+uhKQm0umL7dov2wXsAgUy:zILCDvKqmndEc9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109912, "uuid": "358c18c1-d24f-4209-a4ff-a55d1df44af9", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109912, "uuid": "189681b6-97dc-4b61-973a-8590dcebe306", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109912, "uuid": "5a059340-2bb5-45d4-83f6-aefdcaf8b827", "value": "SOA.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae7f6f2-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617108537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108537, "uuid": "e42712fa-9e0c-4c14-8674-7f57f171e609", "comment": "Malware payload (Quakbot)", "value": "65c76c2b58c4f58241d2d907b2e6c173", "object_relation": "md5", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108537, "uuid": "4a809c3f-f627-4e27-8cca-4c167ddd4de2", "comment": "Malware payload (Quakbot)", "value": "9ecefa4537c1daef76a3ab598a3591ccb87e28f47783af3223bed5d99f4ee519", "object_relation": "sha256", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108537, "uuid": "ea5ecae1-3ce0-4643-97c2-9efe4fb2cbb0", "comment": "Malware payload (Quakbot)", "value": "030457deff0ae69dc3b890cfe5e999055e2c58c7", "object_relation": "sha1", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108537, "uuid": "3f81c9db-5e68-43c2-9069-6392cbaced26", "comment": "Malware payload (Quakbot)", "value": "2e964f45a569b336df837f1540ac2022aa5b25300218e77e8148e6c96e04da60fe07d30caf02caed5aa406737d6e3c86", "object_relation": "sha3-384", "Tag": [ { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108537, "uuid": "2c2595f4-f66f-4d12-a12b-9283ddd185df", "value": "1AB3D09E7380794FD38FB93EA946B8E729170091E566B53F35B0BB0990992C70F5E08D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108537, "uuid": "6305005e-0e3f-4a1a-8d02-36fe1212bec3", "value": "1536:JyDxR6TKZukM2rzz3tTv7xVMsigZEQNggMorCKc1SQpaDw2Rv45N64C:klsKkuFTdV/vEQSlcCNSVDOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108537, "uuid": "bde9517b-023a-44e3-a820-704de629a496", "value": 108108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108537, "uuid": "d71b0cca-6c19-4cb3-b870-f1564198aeba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108537, "uuid": "490eec16-12f6-4b40-9744-52980f845038", "value": "impr_64.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b0228c-9166-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617115300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115300, "uuid": "8149d41e-df40-4cff-bd27-aabfaa80ca2f", "comment": "Malware payload (Dridex)", "value": "24f0f8e7dd8b3faa5b1f89ee6850ae2b", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115300, "uuid": "16d4f4ed-edee-4711-b8b2-fd4d7ad6c1c5", "comment": "Malware payload (Dridex)", "value": "9ef6a5a9b2f11bdcc5df584183b8fb1b3cf3dc8fbd8472ff4d74321506bb3f28", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115300, "uuid": "60a1fe9f-2b77-4fa4-939c-7857252ec77f", "comment": "Malware payload (Dridex)", "value": "89e3eecbab8650b4c074ace3f578f3a793ce6201", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617115300, "uuid": "580509d4-7151-47b4-a04d-8cf9d2faf9f3", "comment": "Malware payload (Dridex)", "value": "2ebc63d738d4550a46600eb525d82c267caaa2e4ee01c43f8c8dffee1c11be4a86b825c0bd3d3829eb2aa6e622e15054", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115300, "uuid": "b2c2608c-def2-466c-b836-7db65ba91a73", "value": "FB14BE2DE333D495FFF7CAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115300, "uuid": "9d80a59d-6dd9-4684-91ac-9da767bffc8b", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115300, "uuid": "5eda854e-45eb-42b5-9988-ac8416ec0a8f", "value": "3072:F3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:FJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617115300, "uuid": "81412649-4444-45af-b72e-b8770d5a10c9", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617115300, "uuid": "303ae81d-8628-4743-82ce-b363ab557f7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617115300, "uuid": "e411fb3b-ede3-463c-b666-f3634c5d58c0", "value": "9ef6a5a9b2f11bdcc5df584183b8fb1b3cf3dc8fbd8472ff4d74321506bb3f28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d511bf-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617085576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085576, "uuid": "0e31772e-8417-4f75-83c4-1349d8a27902", "comment": "Malware payload", "value": "74b09f5cbfbb0b389bc0112dae742e66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085576, "uuid": "532865ba-cba8-4998-9c5a-e49a74a98496", "comment": "Malware payload", "value": "9f033e50cd2599b6dc7587aa941f33d82ea6eafc1083ca6887ab05e13316b575", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085576, "uuid": "ae0e9290-dcd7-40e5-9c1e-f959dbefea13", "comment": "Malware payload", "value": "1f2f3de3ecac270b2b0f7b1dd0fdfd603dabc254", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085576, "uuid": "a1e9bd39-2e6c-4fab-a936-5fa032938842", "comment": "Malware payload", "value": "b35e8f091919ebd909019f29e66e8f8a8321fe341190ce960bd4e4b3721e637217850e01e4b970f92f663befdf5972c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085576, "uuid": "3186faf9-c5e7-4937-9f4f-76f937525636", "value": "0A53F1691103BFCB85863C3D7EECA9CF0838BC24D4A4984698DF4CFE4B96CD5A8DA451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085576, "uuid": "874baea0-4125-40b5-8104-bac0e5e26c2c", "value": "1536:sIvG1iQihkck+FK+oXEIaaTFcxmn7jUaXUlox:7CT1+E++NVxcYoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085576, "uuid": "867e8a24-8d60-49d6-922d-49b738c73869", "value": 62439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085576, "uuid": "2b46496e-81a4-4db0-8580-e13310c391fc", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085576, "uuid": "e7d6a03a-6354-4ee7-ac69-5cde32093e24", "value": "R ALHTQ19-TYPBLDGP0401-940 GR2P5 -NASE FERDAN Q0539 NE-Q22.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4afce85-9181-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617127156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127156, "uuid": "b1e4b9c5-5ae3-467d-8c3c-3e7c6b4df42f", "comment": "Malware payload (IcedID)", "value": "676151b02302c2fcbe6548c859dd9e49", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127156, "uuid": "2089387e-9c02-489a-b68a-169cae98c65d", "comment": "Malware payload (IcedID)", "value": "9f1d9bbaff2834efdbadcd87155bd45a769bf5223ed4b6224ea19d230690b3c4", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127156, "uuid": "054badda-ecbe-4813-80b2-029d1aeb26bb", "comment": "Malware payload (IcedID)", "value": "58fb4505be6c6ecd69458b5f032ac51312a9fa21", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617127156, "uuid": "65fbfdc0-5e34-413b-85f1-fced7f31d24b", "comment": "Malware payload (IcedID)", "value": "0bb3ce37f171ddbf075b8b99d1ada9c1d9252e578c1d55e5b3fc9dd24de1bf96c7d2972bf52419aec9d4d2dec4816a01", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127156, "uuid": "1c6a93d3-39e2-4944-bf90-d425072fab23", "value": "5DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127156, "uuid": "bf550888-bd8c-4bef-86a6-2d7a87220f66", "value": "3072:U2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:UzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617127156, "uuid": "931d7d60-6b38-45ec-bdba-5fb5c76c54df", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617127156, "uuid": "b7451107-b7d5-4a9d-a06d-e78a03168958", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617127156, "uuid": "f517b082-5b33-4cc1-8288-bb8df5e24347", "value": "document-805630311.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff84285e-9196-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617136328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136328, "uuid": "98fb3ca7-046b-40fc-81a9-8ab033055094", "comment": "Malware payload", "value": "cccc17b6e165802601030ffebb232874", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136328, "uuid": "8c2a1a73-4a23-42d9-861b-ed6d4315bf35", "comment": "Malware payload", "value": "9f34ca38cc1a0462c75d69cc4b5de1ff43d6f04de4ea0a8d972d007953f499a0", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136328, "uuid": "07b5a1dd-ffa2-4596-8d64-dcaeb830aff1", "comment": "Malware payload", "value": "6579a30a2d3e8ab25c8ad4c64dca6c62751d6970", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617136328, "uuid": "32423366-894b-4633-95b9-53af38d561bb", "comment": "Malware payload", "value": "7e377d1b7c6835c96093aaaf4e758639d64d7eb9a1dc22db6fac7aabe0a3d716be11dbd1b5302bc006dd55f10b760f64", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136328, "uuid": "20fc04c7-c47e-4771-af82-b95cceebe0c8", "value": "6514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136328, "uuid": "2c284963-54a4-4024-bc2a-8895915be95f", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136328, "uuid": "9f41efc3-3e3a-46e0-8ca3-a4eb46d92cdc", "value": "3072:Q3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:0Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617136328, "uuid": "28139ca1-3864-4ae7-a2a8-92407bd5d3ee", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617136328, "uuid": "477853fc-082c-4d93-896f-6beba6f3ecb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617136328, "uuid": "98440050-067c-45e9-a2c5-da0479cb2de6", "value": "9f34ca38cc1a0462c75d69cc4b5de1ff43d6f04de4ea0a8d972d007953f499a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6378f940-91ad-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617145944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617145944, "uuid": "be1fdc01-2e5b-4d51-8516-a349864edd80", "comment": "Malware payload", "value": "e99108f6fd446df190fca2b499634a05", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617145944, "uuid": "8bc5df89-40be-44c8-8374-ef47b5187ab6", "comment": "Malware payload", "value": "9f43a1350e959256368e9a32d816ba67bef1a15910b29d4a5ab16667dd087be8", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617145944, "uuid": "f3111b4c-b1d2-41e2-a852-d2b2f01a1a30", "comment": "Malware payload", "value": "49962a2cf10bef6762b9657f8f91423362cc866b", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617145944, "uuid": "830e228d-6375-47cd-9698-f32293da8a07", "comment": "Malware payload", "value": "86b29b969e04fbf6de2532e3ce0a87f6196d010c44ab5e07cddb6dcb7c690b0d23241ad0437cc834df7b3141a6dd7f60", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617145944, "uuid": "56727985-dea6-4d43-b460-7dacf4f4308e", "value": "A814BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617145944, "uuid": "9d1ce028-e634-46dc-8c09-575c539a7295", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617145944, "uuid": "a8efe844-c81b-42dd-a02f-1830cf1cef2c", "value": "3072:m3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:CJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617145944, "uuid": "5428818d-75f9-4265-85f4-1cf272cb7b42", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617145944, "uuid": "20db00fa-068e-4d36-84f1-4e0ba4f71f71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617145944, "uuid": "2eb984a7-789f-4bce-a95a-37caee14aebc", "value": "9f43a1350e959256368e9a32d816ba67bef1a15910b29d4a5ab16667dd087be8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afafafb9-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121591, "uuid": "08f6e9ae-ef3f-4524-b540-c4e666ec1ff4", "comment": "Malware payload (IcedID)", "value": "f200ccdac428ceb12b0bc980d2fa03a9", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121591, "uuid": "d3a0dfc3-4463-49a4-8d9c-29b60ba54140", "comment": "Malware payload (IcedID)", "value": "9f45de0e4e93d67c1a943a12e4a00511103abb2fad31ca06d4375e84772b91a7", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121591, "uuid": "70c1c5d6-11f3-4053-9d61-d90932e24cab", "comment": "Malware payload (IcedID)", "value": "6419f393fca582f22813ef51a99f9aaf95b11557", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121591, "uuid": "718fafdf-4bc0-4e77-befa-953841124b9d", "comment": "Malware payload (IcedID)", "value": "1e0ce3baf8052596cda1f3b54dc6c17e26ac693f1dec2bf53d0f3e6c58b89ae6c5f25e50316a532d957cbc8904cb5e3c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121591, "uuid": "b75cde1b-cf81-455b-a6f2-3105e3d269c8", "value": "B1B3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121591, "uuid": "72e82387-391b-42e1-9105-ff31b873a953", "value": "3072:I2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:IzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121591, "uuid": "058ad7e8-09fa-4e7e-9149-7e1fdcee2d5f", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121591, "uuid": "2b621e44-546e-4234-b82e-655234e7f800", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121591, "uuid": "6c20249d-10f3-44ba-90cd-1b1d857064fc", "value": "document-1293284312.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e5e516-9176-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617122187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122187, "uuid": "159f8b86-04e5-446c-8209-ebbc0fee8f4d", "comment": "Malware payload (IcedID)", "value": "53e6f135ed42fca7f60789b7db08a3f3", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122187, "uuid": "1d690e2b-0593-4ef5-bbd7-991edb909074", "comment": "Malware payload (IcedID)", "value": "a0c39c3afd4b38e4a7fffc5561e260c71cbe7612f741ef88719aec306c9fe613", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122187, "uuid": "26e86155-5eb6-4a56-9e94-104828ab9a68", "comment": "Malware payload (IcedID)", "value": "f8cd609dfc944e0728c4835b5e08ffdb0e8cc2eb", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122187, "uuid": "c7cb77bf-deaa-490b-9d57-2fbe26642238", "comment": "Malware payload (IcedID)", "value": "5b1b49659e64149cf1daea4a25557fbaa56b9cc02628934e7a894b8180d44b48498d250b29f957378a492a6c4ba4fe75", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122187, "uuid": "a94f434f-3308-4503-8a07-f5ec8e6f5d84", "value": "3FB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122187, "uuid": "c06610b8-0cd5-4a90-94a4-ce5d776fb7e3", "value": "3072:s2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:szxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122187, "uuid": "39f2dfb8-7519-468e-9ea3-a36a8fa60334", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122187, "uuid": "d7c4e8c8-079c-470b-a6e2-5eeeeb7e7494", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122187, "uuid": "68ffd70a-c6f2-4ec0-a5e9-547de636762e", "value": "document-1017471075.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa76c9d2-916d-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617118576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118576, "uuid": "91e2619e-45a6-4d78-9119-a47d85eebc21", "comment": "Malware payload (IcedID)", "value": "38e7d8ea0f562086181adc72ae91d75d", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118576, "uuid": "41c273af-f94f-427c-be94-3c889e1b58ec", "comment": "Malware payload (IcedID)", "value": "a0dfb80c1a781355611525cc49aadcd7c5d79044264c72440efd2c71a2569f47", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118576, "uuid": "e14bd5c3-d804-4767-b813-ac0b76d69e0d", "comment": "Malware payload (IcedID)", "value": "19ef0cd1b288401672477e361d42347182ab8462", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617118576, "uuid": "9bd7c86b-b2e1-45cc-b2a8-e1240d40b680", "comment": "Malware payload (IcedID)", "value": "6fe7c15a9104e14da6988f603ca9a8c0c48271ed3b760abe360606203ca41b5ec197e0f1cf1a3b1e3df40eb953e6a1d5", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118576, "uuid": "8a92fa47-8c8f-4f80-a24e-25a03c543759", "value": "FCB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118576, "uuid": "8d09cceb-41d2-4cee-a45c-cd92008bcea8", "value": "3072:Q2CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:QzxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617118576, "uuid": "58c94ef5-db87-4bbd-a26a-c30dc8c3cd27", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617118576, "uuid": "507460f3-5d09-4583-b05f-514e28697ae0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617118576, "uuid": "5824cfb8-3d4d-4432-bf70-d8285d9276fd", "value": "document-2039586388.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916f5fac-914f-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617105649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105649, "uuid": "aed1f2b0-8f50-4e4e-bfa2-94655b2acc52", "comment": "Malware payload (AgentTesla)", "value": "ccedb739252ee00eb11f67258d9a35dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105649, "uuid": "bb850a4d-843e-411c-b86c-36155f6ee825", "comment": "Malware payload (AgentTesla)", "value": "a12d024ff06845c1ae64807bea25f228cbfcbf9a283a2961b86f49e1da6c6db4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105649, "uuid": "ca8da709-e398-471e-bf3b-25ff357f9a27", "comment": "Malware payload (AgentTesla)", "value": "b9c1f6670ef7fde72d45cbc2a97c97697f06b05e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617105649, "uuid": "b655abdc-d5ac-4a91-bee9-541e3cf389b9", "comment": "Malware payload (AgentTesla)", "value": "28b1313ca1b28b77ec3c334adc2f816e10e51e7683f7a0e99ce42de9e47ef8467edba8080e02b1b055eba7c7ef20495c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105649, "uuid": "f4d3b9f7-6d21-4520-bc72-cd3e26d16cf1", "value": "E48423B2BD658A2FC34F9FFA9A5FE90099348C56C215A13F75297D364C31708CDA2392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105649, "uuid": "af8de557-4039-482f-b5ef-3c2955bdf66e", "value": "6144:5tTVP5dB9FXaqqmA6J9Bun1aELd/XRt+V5fYXc/ikv3qcenhQ/3A:TVBzXZqmAU98n0eBYTX/iE3j3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617105649, "uuid": "d3d3c589-b616-46f1-809e-433dcd5e9e59", "value": 403968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617105649, "uuid": "5e3b2a09-58d7-455b-99c8-89c723d46725", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617105649, "uuid": "d8d49cb9-9e8e-4554-ad6f-1bb7c702f98b", "value": "PAGO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c935f3-9177-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617122992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "d3cc7903-66f3-4c0c-bab9-ba26149a2a8c", "comment": "Malware payload (Dridex)", "value": "85ff85df16004c40808c192bebe6086d", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "a23d6462-c5fa-4d3e-b266-4c1a91c20da0", "comment": "Malware payload (Dridex)", "value": "a1752a1bb16ab9c2d0dbd054f122a25d0ed1d9f7ec09ec8221a06f5ba2c979ef", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "f10cda4a-b59d-4e69-8965-85deebd6e987", "comment": "Malware payload (Dridex)", "value": "cb72db841eff7debd6da1d3936ce821bb44094ec", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617122992, "uuid": "12757c03-374f-4757-8b50-b1b62234f746", "comment": "Malware payload (Dridex)", "value": "258ca5018dbc3d947a42a5a98069222135087ca5cccbf2bab173a16264e06924c73938b5d306231076dc3a4468600aea", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "2be6c5bf-c692-4f4c-ad94-3ade969b84df", "value": "AE14BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "4151f43a-bbb2-48ca-974f-6ffa1149b68d", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "87ada028-f783-4eba-9be9-fa3964bbe348", "value": "3072:s3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:IJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617122992, "uuid": "b017c43e-fb6c-435e-873f-8c258b076fff", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617122992, "uuid": "78d63722-7585-416b-8db4-0594947a46db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617122992, "uuid": "9a8e9a2a-ccbd-4c7b-8ada-4f0afcfdbaeb", "value": "a1752a1bb16ab9c2d0dbd054f122a25d0ed1d9f7ec09ec8221a06f5ba2c979ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfac8b1-9174-11eb-abe1-42010a9c0039", "comment": "Malware payload (IcedID)", "timestamp": 1617121588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121588, "uuid": "2e9db099-5b25-4638-ba26-ce1ed6ef1a5e", "comment": "Malware payload (IcedID)", "value": "beb8bba6a42019ce41de387af9fe425a", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121588, "uuid": "be0b69ab-3af1-4d29-847e-918fb19298cd", "comment": "Malware payload (IcedID)", "value": "a1c74b07693b5c505edf3682a1c0703229eff8e71b3d61718b59c06e993df226", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121588, "uuid": "e9328329-5a74-4423-8ab6-6a9666d977e8", "comment": "Malware payload (IcedID)", "value": "64a0021ddd2265ff3b6770e18665811e68fac535", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617121588, "uuid": "59723418-0b50-4d20-a76f-70bf2261e2c9", "comment": "Malware payload (IcedID)", "value": "541ebf58805abaec9824175352d7eb24279457a4a29105d55716a30b99809e9a0653943701730b64c93e0efe56a3efa8", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121588, "uuid": "b96e00cf-4a42-494b-bf1e-733894d58ca7", "value": "5DB3D0AD8B02F5BBD294DE3CD04AB4518EB691732F0F751B24AE439B0806DD61D1F62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121588, "uuid": "210c4b0f-3fed-47ed-845a-4e56f196bc64", "value": "3072:82CxNFcWr5qQDzPjEwqtDpko+bJ99K7meX7pD/:8zxjYDj+d9imeX7pD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617121588, "uuid": "00a0a3da-28af-4ce6-9329-8d18bc2553aa", "value": 108063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617121588, "uuid": "39daa6b6-fec0-4a97-9d44-e844891986d7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617121588, "uuid": "c32ca034-f88f-46fd-beb6-e659b3ea83f0", "value": "document-864524281.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25f5e3b3-9152-11eb-abe1-42010a9c0039", "comment": "Malware payload (GuLoader)", "timestamp": 1617106757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106757, "uuid": "99fc288e-930e-4dea-91ca-fab7055e3edb", "comment": "Malware payload (GuLoader)", "value": "edeff76475b73d1ea8f9f8eb8afdb738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106757, "uuid": "0f004ce9-e75d-4737-9f40-8d39feaf61a5", "comment": "Malware payload (GuLoader)", "value": "a214379d617efa77932adcbd90240cf0fb0ba443b50d4f93475edde4d53b1681", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106757, "uuid": "2a0588dc-fae6-4f02-a691-ab35a6738cb6", "comment": "Malware payload (GuLoader)", "value": "0ec4cf852db313d8d6c7896f4a8fd10f73228749", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617106757, "uuid": "2bd5437d-e71f-4363-b384-273301f0e91d", "comment": "Malware payload (GuLoader)", "value": "ecd478c870de69fa0d41a278638ebdb03ac57e9a8d820fb18c80a6865901546f67153605fa8acaef34456250a5b3638a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106757, "uuid": "85b9a1bd-ddf7-445c-9a17-fcb08f44c3c3", "value": "DFC3C752677CFFE6C96489F1FB3827AC10586871090AD843B1C7392CEA729D591A33B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106757, "uuid": "0d92a3da-cf8f-4fd1-9740-6187efd6de17", "value": "6ea4bc64786f6c0830d4d2794c2af5e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106757, "uuid": "2b3d5194-b218-48d3-ba57-40956d548017", "value": "1536:QHkRBdOqELc7FRQe4AdbrS50h3yqiL46R2AvVvYF1ZfwXE:FD7FZRkElF4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617106757, "uuid": "0341e1b5-40a3-4bc0-a762-cf40d3ca9fec", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617106757, "uuid": "a45b4bcb-290b-4035-92a6-d017bf8afb7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617106757, "uuid": "f1ec2b85-7055-42fe-8b57-04728e3bd705", "value": "CopyDocs-BUSINESS-CONFIRMATION_NO-MGFT560_0w9wMGT500383RRTF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd47e3ac-9170-11eb-abe1-42010a9c0039", "comment": "Malware payload (Dridex)", "timestamp": 1617119896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119896, "uuid": "859f103a-381e-453d-876e-599882f7088a", "comment": "Malware payload (Dridex)", "value": "9669d2aa9006b6d909c4369f60862773", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119896, "uuid": "728d4779-f01b-4660-97da-a02e5c3323fc", "comment": "Malware payload (Dridex)", "value": "a232ca84f00056183f3c174c7fc557e39c82131d2a21fa1781fb0f03f85bf245", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119896, "uuid": "52d365b7-98cc-4912-8036-e8abea821d03", "comment": "Malware payload (Dridex)", "value": "045fd7d2afaa8e4927fecd2baca2e47824ef0942", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617119896, "uuid": "50da4d60-3563-49a5-abe3-6148888c829f", "comment": "Malware payload (Dridex)", "value": "41b077c11fef264c2c8bb71c98919c438d2285a6f04caa43472eda1f4f5e422988345a39f5b89610f7b3cfaeef871324", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119896, "uuid": "d38602df-e6b2-4b77-b4b9-9a5d3c271014", "value": "3514BE2DE333D495FFF7DAF41492AA2A8A7B2D00822F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119896, "uuid": "80c101f2-e5df-449d-acb1-8d4dc9b22c96", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119896, "uuid": "c0a0f8ba-e385-4a98-b32d-faa83fd4d889", "value": "3072:O3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:qJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617119896, "uuid": "ecf65e5d-8ac2-4a81-8c40-64953e2ac45a", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617119896, "uuid": "dabffdb8-6798-4197-aece-bc0612758d0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617119896, "uuid": "e3c339aa-6fa0-4e05-9bd4-b657ef479123", "value": "a232ca84f00056183f3c174c7fc557e39c82131d2a21fa1781fb0f03f85bf245", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1945e038-918b-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131217, "uuid": "3b7ca3ae-2e79-4bad-a8a4-c85ee8a7f345", "comment": "Malware payload", "value": "2b5b6303a2189a28ba44fbcec818dce1", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131217, "uuid": "706c3cc7-eeb2-429b-9b0f-9307adc8b71e", "comment": "Malware payload", "value": "a26a7e6523f18c80199c7959528480f72ab5d132830a7f47919c9226ab8e35cc", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131217, "uuid": "d02d4a69-eddb-4c4f-af63-d50f9b98e2f2", "comment": "Malware payload", "value": "49eeb9921c6560d991c58af95ead135ce359bcd3", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131217, "uuid": "c8b06ff5-919c-409a-a159-8ea33c7896d9", "comment": "Malware payload", "value": "a8e2953e6f3401ff2f96860309a99e8d3fd63dc5c5e44eb77a1cf1f256789bb4c5b344b65855e793fba84b6b9f2b853f", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131217, "uuid": "e43a2b8a-dc40-4788-b0c0-89a68e8897f8", "value": "5514BE2DE333D495FFF7DAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131217, "uuid": "2261c0a4-24c1-4411-90fd-1f5233ebd711", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131217, "uuid": "1e227eac-45e4-41fa-b932-c13f595a7d97", "value": "3072:e3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:aJf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131217, "uuid": "a311b5bd-f5db-43fb-abcc-b9d6e927eae0", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131217, "uuid": "30c57421-a66e-45fc-8b0d-b8cc3d28f567", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131217, "uuid": "e8adc936-e0a4-4d31-8c2c-56e82b7f0027", "value": "a26a7e6523f18c80199c7959528480f72ab5d132830a7f47919c9226ab8e35cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183e8d7a-9158-11eb-abe1-42010a9c0039", "comment": "Malware payload (Gozi)", "timestamp": 1617109311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109311, "uuid": "2adaf6ed-8230-43aa-858b-e9198d30704a", "comment": "Malware payload (Gozi)", "value": "10af54e12b38b589f555e7b3c44f125c", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109311, "uuid": "cab60479-6eb7-45c8-8792-58aab1d28079", "comment": "Malware payload (Gozi)", "value": "a2868490b4da6dba37ea8f418e2aa2b42b90db28311f69e9f56ce97b4d8ba0ed", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109311, "uuid": "36f24296-ab63-4cc1-bc14-a0043f498e8e", "comment": "Malware payload (Gozi)", "value": "e20f4cd1d9e121035c5d34cd6514015c81bec0ac", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617109311, "uuid": "a16a6473-da3d-47f6-82ec-e416600c5c85", "comment": "Malware payload (Gozi)", "value": "864482d0a14ee6f35ac84ea03c2f6f8ee1dc5c0136cd3b09debd9108d7d4fe0470e52e7d2fec19e2860e68e3a0896fbb", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109311, "uuid": "4deb183e-4437-49ac-b854-25d1f12fb0de", "value": "DEB3B0BCCB06B0A7DA54DF3C814AB0918EA580732F1B722B158E515F09079DA2D3E67F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109311, "uuid": "cfbc8d4a-aa2d-4c89-999b-c4901c9d75eb", "value": "3072:e26TGqT+dY7EDzPjEwqtDlko+bJ99K7meX7pD3:eLTGa084jYDv+d9imeX7pD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617109311, "uuid": "d399eebe-f4af-4575-8d01-2359e7eca411", "value": 108510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617109311, "uuid": "807cc9b7-7fa5-44bf-b485-1a8fdb86f0eb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617109311, "uuid": "fff38990-de86-4337-adf3-c38ce93ad5e7", "value": "document-1529481003.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceadeb0-918c-11eb-abe1-42010a9c0039", "comment": "Malware payload", "timestamp": 1617131653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131653, "uuid": "80c7abc5-a337-4640-b7f7-706ede20902f", "comment": "Malware payload", "value": "28cfe640c19ff4a21fbec19b4012ef8c", "object_relation": "md5", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131653, "uuid": "76959f2a-f504-442d-b0c8-533fc0aeb18d", "comment": "Malware payload", "value": "a2a1854bca1533d7fa00b96f19f75dba53ca3f7ae33a0fb148e22e874c8fee8a", "object_relation": "sha256", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131653, "uuid": "ffff6d25-980f-4f9c-bf3e-6f7ea9ba905a", "comment": "Malware payload", "value": "3bd084644dd6b23e0cdf6d57dd9de2d95ac739f6", "object_relation": "sha1", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617131653, "uuid": "3015ac89-c985-45db-a7ea-66ee8a8be11a", "comment": "Malware payload", "value": "d38c93f4f8097ffa267146c07b3b1ee68fb1279715db6fef16fcc52c385df4fdeff056fbe8e5be8b9d256706437c3331", "object_relation": "sha3-384", "Tag": [ { "name": "111", "colour": "#516FBD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131653, "uuid": "b63a241b-716b-496a-b763-e61f01b9328e", "value": "E014BE2DE333D495FFF7CAF41492AA2A8A7B2D00821F6918B8C1253F85BFD4C656505C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131653, "uuid": "3bd3f314-f564-4d8b-a294-ef3928d2b0da", "value": "83d796265350c32d1620e20795556bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131653, "uuid": "8f3ed4e9-618b-4a0d-a9a6-6b98828f76e5", "value": "3072:b3PkKzL/T8ouwbQ5ynvLPhSf6mPqeWiYIsjW3DlV+VZ/urJtJah:7Jf78sEYzPQymSeWima3DlV+/2rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617131653, "uuid": "7cd25d9e-529a-4bb3-99cd-8ff142e55257", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617131653, "uuid": "5bed81af-942c-47d0-bf3b-dc10a96be443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617131653, "uuid": "dac04a64-4ddb-457e-8137-139f0dd337bd", "value": "a2a1854bca1533d7fa00b96f19f75dba53ca3f7ae33a0fb148e22e874c8fee8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb84b05-9156-11eb-abe1-42010a9c0039", "comment": "Malware payload (Loki)", "timestamp": 1617108592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108592, "uuid": "33f84749-7fd5-4ab6-8628-49235b0a5d68", "comment": "Malware payload (Loki)", "value": "bd4715425fda6239e6efc018c908472b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108592, "uuid": "4d0e0379-76db-4b33-b18c-35bc449b2b59", "comment": "Malware payload (Loki)", "value": "a2d4e9fa9a1c8c0cfad6267250a71b65c262219d3f4fb43a348103aa3f08ebfb", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108592, "uuid": "ee5d1d91-1b16-4805-82d8-43960f7d039d", "comment": "Malware payload (Loki)", "value": "14945f89021f8b41aa8b7dee9c6242d5fdea4a49", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617108592, "uuid": "1291e85b-0183-4d2a-a794-620436fec55c", "comment": "Malware payload (Loki)", "value": "31170731ab227096cfeb76f60e0f34b11cea0029d51e09cd12ac61732ff1a0d78423880734dfc31a6d35560e53da8dbb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108592, "uuid": "36a6837d-da47-4452-9c90-68c60bef198a", "value": "B86423A3684340D4EE286EBF6AB38DDCD843AF3141F16444EE669E343D63A51165E3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108592, "uuid": "e095a75d-501a-4021-875e-e2bfb25407b7", "value": "6144:3KvHfqnSd3zr8wmkjwNBsYrFqMAKxwHCMeiMKmPkZ6dPb4WRRjTLy2zAbPKtKTiK:3KH1FzYwmkYxUMAK4cbxcZ6tb4Qjv7ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617108592, "uuid": "68309fea-b65c-45ec-866e-c1aebfa8eaeb", "value": 316479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617108592, "uuid": "a5479869-dd46-4b46-a30e-3bb1a7e0395c", "value": "application/x-lzh-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617108592, "uuid": "00c817d7-0c63-4e68-ad98-a382ba4e6b3c", "value": "Resize_Drawing-RFQuote_PO.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d672caa-9120-11eb-abe1-42010a9c0039", "comment": "Malware payload (AgentTesla)", "timestamp": 1617085456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085456, "uuid": "8da09b87-3867-4c8f-8a11-6769d5c0a016", "comment": "Malware payload (AgentTesla)", "value": "a6a69cb71d3ea908e6ad0622f42d4694", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085456, "uuid": "7ec93d54-cbf7-4f57-88ea-8dfcfd37fca4", "comment": "Malware payload (AgentTesla)", "value": "a392bd79dc9ce4f4a4696986c50555cda469b71ab16793ff202b194479ce3057", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085456, "uuid": "f52afd87-5bc9-4eb7-aa3d-f84d9963f98a", "comment": "Malware payload (AgentTesla)", "value": "e853a920d561fc74f4674cdede6087006f36f98f", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1617085456, "uuid": "d4259470-de89-4d68-afa2-95852b84d1b9", "comment": "Malware payload (AgentTesla)", "value": "b738269ff586f18c12958a734e8cbd0755ac2bd7116238ba6fb36a2ae6aa796fde9b0eb6dc8aae55981ae5e85458798e", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085456, "uuid": "5796b9c1-6cf5-4254-8edb-372347457b60", "value": "6C2533B1A24E1EE0B1F3BB8EE8BE416B7505B842F63DA5D6271EEC444F8562B014E509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085456, "uuid": "d15bc326-2a22-4f6b-9b2d-7cf0dad33f69", "value": "24576:gbpnTmxaJHu05P5YY6iSY8KHgE9332xx089+1iWNN:0nysbYWPgE93mxxf+1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1617085456, "uuid": "eeb5f742-8513-47e9-b04c-8291e4e61805", "value": 963534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1617085456, "uuid": "6f14c1dd-e23f-4012-8a8e-78231a23e42d", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1617085456, "uuid": "b2e00e9d-5c72-4a50-8f06-c383d080373e", "value": "Secrecy Declaration for Bangchak EURO V Project.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0891e9a4-9114-11eb-abe1-42010a9c0039", "comment": "Malware payload (Quakbot)", "timestamp": 1617080079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1617080079, "uuid": "bfccb8b1-7ee5-4a49-a3c5-7b9e34f937ca", "comment": "Malware payload (Quakbot)", "value": "f9f342620b7fab2fe2784438961a4cd4", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "pwallegato21", "colour": "#AE3AB5", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery",